SQL injection fix