modify all the sql, use session userid for verify