avoid sql injection
one var to array in injection
Merge pull request #15 from ScottTZhang/injection

avoid sql injection