Fix SQL Injection Vulnerability

POST params are being put into SQL query and not being binded. This patch makes placeholders for them and runs separate query with them if condition met.