added SQL injection protection

say that 5 times fast