SQL security fix