diff --git a/app.py b/app.py
index 26aee80..19b353c 100644
--- a/app.py
+++ b/app.py
@@ -69,13 +69,13 @@ def register():
             flash("Passwords do not match")
             return render_template("auth.html", active_tab="register")
 
-        existing_user = db.execute("SELECT * FROM users WHERE username = ?", username)
+        existing_user = db.execute("SELECT * FROM users WHERE username = :username", {"username": username})
         if existing_user:
             flash("Username already exists")
             return render_template("auth.html", active_tab="register")
 
         hashed_password = generate_password_hash(password)
-        db.execute("INSERT INTO users (username, hash) VALUES (?, ?)", username, hashed_password)
+        db.execute("INSERT INTO users (username, hash) VALUES (:username, :hashed_password)", {"username": username, "hashed_password": hashed_password})
 
         flash("Registered successfully!")
         return redirect("/login")
@@ -101,7 +101,7 @@ def login():
             flash("Must provide password")
             return render_template("auth.html", active_tab="login")
 
-        rows = db.execute("SELECT * FROM users WHERE username = ?", username)
+        rows = db.execute("SELECT * FROM users WHERE username = :username", {"username": username})
 
         if len(rows) != 1 or not check_password_hash(rows[0]["hash"], password):
             flash("Invalid username and/or password")
@@ -140,7 +140,7 @@ def reset_password():
             return render_template("reset_password.html")
 
         hashed_password = generate_password_hash(new_password)
-        db.execute("UPDATE users SET hash = ? WHERE username = ?", hashed_password, username)
+        db.execute("UPDATE users SET hash = :hashed_password WHERE username = :username", {"hashed_password": hashed_password, "username": username})
 
         flash("Password reset successfully! You can now log in.")
         return redirect("/login")
@@ -158,7 +158,6 @@ def logout():
 
 
 @app.route("/planner", methods=["GET", "POST"])
-@login_required
 def planner():
     """Manage study planner"""
     user_id = session["user_id"]
@@ -171,7 +170,7 @@ def planner():
             if not course_name:
                 flash("Course name cannot be empty", "danger")
                 return redirect("/planner")
-            db.execute("INSERT INTO courses (user_id, name) VALUES (?, ?)", user_id, course_name)
+            db.execute("INSERT INTO courses (user_id, name) VALUES (:user_id, :course_name)", {"user_id": user_id, "course_name": course_name})
             flash("Course added successfully!", "success")
             return redirect("/planner")
 
@@ -182,6 +181,7 @@ def planner():
                 flash("Missing course or topic name", "danger")
                 return redirect("/planner")
 
+            db.execute("INSERT INTO topics (course_id, name) VALUES (:course_id, :topic_name)", {"course_id": course_id, "topic_name": topic_name})
             db.execute("INSERT INTO topics (course_id, name, last_reviewed, next_review, repetitions, ease_factor, interval_days) VALUES (?, ?, ?, ?, ?, ?, ?)",
                        course_id, topic_name, datetime.now().strftime('%Y-%m-%d'), datetime.now().strftime('%Y-%m-%d'), 0, 2.5, 0)
             flash("Topic added successfully!", "success")