fix sql injection in user/semakan page