updated login with sql injection