fix more potential SQL injection exploits