better sql injection. replace to jsonresponse()