Added a $wpdb->prepare

As pointed out by Juliette yesterday; always use $wpdb->prepare();