Fix SQL injection