Updated FINAL VERSION (runs locally)

changed sql statements to avoid possibility of sql injection