added sql injection cleansing