Added query parameters to prevent sql injections