moving to version 2: sql parameterization, input validation, separation of model/view, and etc...