fixed: possible SQL injection in widgets