add sql injection defense, and hierarchy support for controllers