Some security fixes for queries