added WHERE to sql query