prevent people in insert .. in url [server already checked]