avoid accepting folder paths in query