correct possible mysqlInjection