fix possible sql injection