security fixes on create.php
v1.1 push