Fix SQL injection

Hi Mate,

just a quick fix to avoid SQL injection.