add class statement to protect sql from attack