Security update

Hi, your code largely disregards the possibility of SQL injection. I have made a couple of commits to fix some of the problems that could arise from this, but hope that you will do your own security review and find other flaws.