prevent SQL-injection on selecting url and code