first prototype. TODO: remove SQL-Injection possibilities