fixed vulnerability of SQL injection