Fix SQL injection

Hi!

Your app is vulnerable to a SQL injection, this commit will fix it.
There might be other files in your app that still are vulnerable, make sure to audit the source code for more such occurrences. :)

Here's some more info about this vulnerability:
http://www.php.net/manual/en/security.database.sql-injection.php