moving around session_start based on ivan's comment that I missed the first time and protecting against sql injection