SQL injection, Fixes #20