sqlinjection removal..comments