SQL injection prevention done properly