fixes to sql injection