validation stuff

preventing sql inject