Fix SQL injection vulnerability