add code to prevent sql injection