slightly less vulnerable to sql injection