How are you sending osquery sql? You said there was a custom app here? Can the app parse and do the parameterizarion or sanitization?