fixed a MySQL injection vulnerability