PR: Rewritten queries to protect from sql injection