added extra measures for sql injection