Fix sql injection in add.php file