sql injection fix

I can get past the SQL query by using a token like ' OR ''='
I don't think I can exploit it though as you're comparing the
key with the token after fetching it but nonetheless, please fix
this SQL injection