SQL injection, fixes