fix a SQL injection bug