Fixed Sql injection issue