fix sql security problem