more bad sql