Fix: Possible injection through "language".

Maybe a Cookie-Manipulation or HTTP-ACCEPT-LANGUAGE can welcome some
sql-injectors here.
Fix.