make use of query params, to avoid sql injection