fix potential sql injections