FIX SQL injections

Hi Mate,

just a quick fix to avoid SQL injection.