Fixes #117. Sql injection filter for ${} expressions