Sanitize SQL parameters to prevent very unlikely SQL injection

Thanks again Brakeman