FIX SQL injection

Another SQL injection.

You should also fix the cross site scripting in this page using htmlentities with the flag ENT_QUOTES