sql-injection prevention and making code more readable