fixed sql injection bug