fix for sql-injection in documents