improve security (prevent sql injection) but introduces bug