Fix SQL injection in username

Hi mate,

just a quick fix for a SQL injection
Merge pull request #1 from snyff/patch-1

Fix SQL injection in username