added sql injection protection