commented out a part, made sql injection work