fixed appointment query potentially vulnerable to SQL injection