Mark possible sql injection
Professor controller, list action
Create in professor, but commented out because it may not be needed