escape data before being used in query

dangerous!