crud.php protected from sql injection