Add protection before sql injection: parametrize query.