escape possible user input to minimize SQL injections