changes for sql injections