backend bugfix

fixed a HUGE bug where you could do sql-injection ...
javascript-injection ... html-injection ... everything bad!