fix SQL injections

REMOTE_ADDR is not injetable but others are :)