Fix possible sqlinjection

Change-Id: I366fdddce92eb0c2274135e90b43d55b90ce6de6
Merge commit '5fcf576e14374ac9b638f6ee4870232d20cfeeae'