added test page
fixed bug with sql injection