add function to insert to db. safer sql injection