I have a query that is dynamically created for a search page that Snyk is flagging as a sql injection i