sql injection fix

I can get past the SQL query by using a token like ' OR ''=' I don't think I can exploit it
though as you're comparing the key with the token after fetching it but nonetheless,
please fix this SQL injection