fixed a bunch of sql vulnerabilities, still probably more to go