Update mysql.lua

Fix sql injection