Fix SQL Injection Vulnerability

SQL query is not properly escaped, allowing SQL injection attack via malicious request.