bugfix by sql injection