Fixed #3: Escape every input to prevent SQL injection.