fix sql inj (check array)