enforce SQL username check + return FALSE instead of bailout