fix sql injection (bobby tables) security issue