slash the field names in the query...  consider ways to use pdo parameters.  perhaps global named parameters.