[fix] product: potential sql injection vector