Fixed sql injection