finished permission checking with SQL