sql inject fixing part 1