protected query from sql injection
fixed drill into modal text