Fix SQL injection bug (thanks Igor)