scrub for SQL injection