[rss] Fix SQL injection in rss module