prevent sql injection
still cannot get UPDATE command