fix up sql to avoid injection