fixed vulnerability in sql generated by expressions
ver2.3.2