fix hardcoded sql