we should prevent the user from writing single quotes in their where clause
we should prevent the user from writing single quotes in their where clause