Prevent SQL injection in login script