fixed the risk of SQL injection