fixed bug in SQL injection