fixe sql inject

Signed-off-by: Wadjetz <egor.neon@gmail.com>