Additional correction (but not fix) - the code has a SQL injection hole