prevent sql injection

Signed-off-by: Jamie White <hello@jamie-white.com>