Added escape strings to prevent SQL injection