moved SQL statements from view to controllers