sql inject for number of zones fix