add filter of username,email and fix the risk of entry sql