fix sql injection problem