Move some sql queries to the corresponding managers
fix a sql injection check for updateCard