added some more security for SQL injection