security improvements
- disallowing of special characters to prevent sql injections
- possibility of providing a default "limit" query

changed to a proper object layout