fixed mysql injection vulnerabilities