SQL injections

Signed-off-by: Mattias Andrée <maandree@operamail.com>