SQL Injection vulnerability fix