sql injection bug fix