added input filtering and recoded db to help prevent sql injection