Remove sql injection opportunity in "question_available_for_user"