Fix possible sql injection