Refactoring to prevent sql injection