fixes to catching <> injection in the query