fix potential sql injection

fixes #4