Finished hooking up the DB. HTML injection works, prevention doesn't