check user and event id, only allow [0-9a-zA-Z]+;
slightly change the sql query