Fix to stop sql injection