sqli protection + secure password lookup