Add a default query limit.

Also a little sql injection prevention never hurt nobody.