SQL injection prevention

Added some statement checks in sql to prevent sql injection.