add function to check sql-inject and cross-site scripting