lots done, sql injection major problem though