security fixes, trying to re-write queries