fixed and commented on some of the potential sql injection vectors