no more sql injection and better tests