fix possible sql injection
fixed date format