Fixed mysql injection