sql injection fix

I can get past the SQL query by using a token like ' OR ''='
I don't think I can exploit it though as you're comparing the
key with the token after fetching it but nonetheless, please fix
this SQL injection
Merge pull request #1 from Remo/patch-1

sql injection fix