fuck it we'll do it live.
direct injection rather than using prepared statment