Fixes user-input

Security issue with user input being put into query.
formatting