fix of SQL Injection