added prevention of sql injection to add form