protected function query($sql) {
        $vars = func_get_args();
		$cleaner = "/[\s,].+|[^a-zA-Z]/";
		$illegal = "/[\\\\'\"\%]/";
        try {
            $pdo = $this->dbConnect();
            $stmt = $pdo->prepare($sql);
            $binds = explode(':', $sql);
            foreach($binds as $n => $b) {
				if($n != 0 && substr($b,1)!=false) {
					$b = ':' . preg_replace($cleaner,'',$b);
					$vars[$n] = preg_replace($illegal,'',$vars[$n]);
					$stmt->bindParam($b,$vars[$n]);
				}
            }
            $stmt->execute();
            return (strpos($sql,'SELECT') !== FALSE) ? $stmt->fetchAll() : true;
        } catch(PDOException $e) {
            return array('query_error' => $e);
        }
    }