fix a sql injection vector from node titles