fixed SQL injections, thanks evgeny