small code formatting
fix potential SQL injection