fixed a really stupid injection vuln that I thought I had already fixed