turns out sanitizing this stuff in software is unnecessary, just use the SQL!