validation done, more secure php done