sanitize sql query parameters
fix typo