fixed sql injection vulnerability in insert