most of sql coding done, TODO: procedure on backtracing access rights and filter!