Extract export file name to own function
Prevent SQL injection