sql binding to avoid theoretical sql injection

sql binding to avoid theoretical sql injection
Merge pull request #389 from dzhibas/patch-1

sql binding to avoid theoretical sql injection