Fixed sql inject / escaping error