add server without SQL injection