sql injection protected login

also added logout link to upload page