Fix SQL injection bug by me