public JSONObject addTestQuestion(JSONRPC2Request req, HttpServletRequest request)
      throws Exception, SQLException {
    JSONObject jsonResult = new JSONObject();

    // set retrievers
    Map<String, Object> params = req.getNamedParams();
    NamedParamsRetriever np = new NamedParamsRetriever(params);
    Map<String, Object> tParams = np.getMap("test");
    NamedParamsRetriever testNp = new NamedParamsRetriever(tParams);
    Map<String, Object> qParams = np.getMap("question");
    NamedParamsRetriever questNp = new NamedParamsRetriever(qParams);
    int tid = testNp.getInt(("id"));
    int qid = questNp.getInt(("id"));

    // load test and question
    MySQLDAO dao = new MySQLDAO();
    Test t = dao.loadTest(tid);
    dao = new MySQLDAO();
    Question q = dao.loadQuestion(qid);

    // load current user
    User u = getCurrentUser(request);

    if (u.getId() == t.getOwnerId()) {
      // check for duplicates
      boolean duplicate = false;
      for (Question quest : t.getQuestions()) {
        if (quest.getId() == qid) {
          duplicate = true;
        }
      }
      if (!duplicate) {
        dao = new MySQLDAO();
        t = dao.saveTestQuestion(t, q);
      }
    } else {
      throw new Exception("no privileges : you do not own this test!");
    }

    // set result
    JSONObject jsonTest = t.toJSONObject();
    JSONObject jsonQuestion = q.toJSONObject();

    jsonResult.put("test", jsonTest);
    jsonResult.put("question", jsonQuestion);

    return jsonResult;
  }