Isn't this opening SQL injections?