fixed potential vulnerability in quoting identifies in a SQL command