fix sql injection

Just 1 example of the issue and how to fix #47. But maybe an overall architecture change would be better.