Fix SQL injection

Make sure that incoming data gets escaped to prevent SQL injections.