cleaned up SQL injection