Fix #4 - SQL injection prevention