load fixed by refreshing model list from db; save fixed by join db query string in classic way (without built-in anti-injection mechanism)