Fix SQL injection when getting user preferences.