Remember to escape sql.