Better sql sanitation

It actually works :D