construct complex queries, need to check if anymore sanitization required for db queries