Fix SQL injection in delete.php