fix for sql injection issue