Prevent SQL injection in several parameters

Just your friendly neighborhood coder here to remind you to escape your inputs!