bugid:96409 fixing sql injection risk