fixes to get sql injection working