remove potential sql injection vulnerability