--added code to prevent basic sql injection