a sql injection point in search box and fixed bugs