fixed not to use direct php variables like $_POST