temporary and unsafe sql-injection friendly save to db-function