Cleaned up code a bit to prevent SQL injection