profile.php sql injection preventation should work