extracted out the admin stuff from reg user, added some SQL injection protection