Fix SQL injection issue when using PDO