Fix SQL injection in username

Hi mate,

just a quick fix for a SQL injection