fixes a possible sql injection
fixes #5