Add SQL injection protection