correct more potential SQL injection exploits