fix sql inject and translation