PHP SQL no inject - possible to remove sql injection