fix bug in SQL statement