Don't put contents of $_POST et al directly into SQL statements. It seems I missed at least one occurence of this in my previous commit.