add sql injection check