Fix SQL injection.[From 360safe submit]