sql sanitize fix