Differential privacy for SQL queries