fix possible sql vulnerability

missing typecast to int added