security fix for sql-injection and cross-scripting of document var in delete script