harden the sql queries