sql-injection fix in demographics