added some sql injection prevention