or if your db is decent enough (postgres) use query_params