sql injection fix for chart_location_activity