fixed SQL Injection Vulnerability