no more sql injection on upsert and no race conditio either!