Sql injection fixes