add 'sql injection and xss' protections