Protect against SQL injection in login script