bug fix and mysql inject prevention