hotfix for sql inject