Fix sql injection and add test cases