add specs to protect against sql injection