parametrized pgqueries to avoid sql injection