Fixed SQL injection security hole