adding sql parameter to prevent sql injection by manipulated session ids