Fixed SQL injection risk