db.escape considered harmful