Fix SQL injection vulnerability

Not much to comment on here...