fixed sql statement for update