simple buy action...order history...prevent SQL injecttion