add another sql injection guard