Fix SQL-injection prone queries in README