! allowedto injects strings directly into the query with manual quoting
thanks arantor for the report

Signed-off-by: Spuds <spuds@spudsdesign.com>