Fix SQL Injection Vulnerability

same as other PR, but with $_REQUEST vars.