improve for SQL injection