added sql injection protection
minor edits