Fixed two potential SQL Injections.  Thanks to Tyler for catching this one.