Fixed SQL injection