avoid sql injection on demo code