improved input sanitation on update queries