Added validation and sql parametisation to prevent expoits.