[points=5] defend possible sql injection

[yinrong]

we should forbid something like:

where: {
 field1: '1 ) or 1 = 1 ('
}