Add where clause parsing to avoid apparent SQL injection vulnerability (fixes #2)