Fix SQL inject possiblity

query is better than execute in case of invulnerability