[enh] add SQL-Injection protection