no longer vulnerable to SQL injection with queries. We still are via inserts (updates)