fixed sql injection hole