Fix a minor kind of SQL injection

There may be others.