   }
 
   func insert(content: String) -> Post {
-    let sql = "INSERT INTO posts(created, content) VALUES(now(), '\(content)') RETURNING id"
-    let result = try! c.execute(sql)
+    // TODO: authentication
+    let sql = "INSERT INTO posts(created, content) VALUES(now(), '$1') RETURNING id"
+    let result = try! c.execute(sql, parameters: [content])
     let id = result[0]["id"]!.string!
     let created = result[0]["created"]!.string!
     let post = Post(id: id, content: content, created: created)

  }

  var all: [Post] {
    if dataCache.count != 0 {
      return dataCache
    }
    let result = try! c.execute("SELECT * FROM posts ORDER BY id")
    let posts = result.map { row in
      return Post(
        id: row["id"]!.string!,

      return nil
    }
    set {
      // TODO: authentication
      if let post = newValue {
        try! c.execute(
          "UPDATE posts SET content = '$1' WHERE id = '$2'",
          parameters: [post.content, id]
          )
      } else {
        try! c.execute("DELETE from posts WHERE id = '$1'", parameters: [id])
      }
      dataCache.removeAll()
      if all.count > 0 {
