Fix SQL injection bug

Left out a bind_param by mistake.  Fixed now.