Forgot to escape one query...

Darn! Although, Kata does escape all incoming params ... :D