BUG: implementing dmpop's corrections on sql injection prevention