sql inject bug fixed