Fix SQL injection

REMOTE_ADDR is not injetable but others are :)