Category avoid sql injection