#75 fixed; now, query is being passed by params, what protects agains sql injection