fixed sql injections, possible admin errors