fix bug SQL Injection