fixed sql

preventing mysql injection