add charset=gbk encoding to prevent SQL injection