prevent sql injection on edit form