do we need to worry about security? We're passing user parameters straight to the database here aren't we?