trying to fix sql injection