Fix SQL injection vulnerability in manager