SQL security holes closed for UserDao.