fix sql-injection
fix json_load source URL.