avoid builtin sql injection

[larshp]

SELECT + INSERT + more

note that it is not as bad as it sounds, the SQLite database is initialized on every run

prepare everything? https://sql.js.org

https://sql.js.org/documentation/Database.html