Add SQL injection protect