[sql] [fix] fixed item.py injections