Fixed possible sql injection