injection protection now working.

Previous function returned a washed string but was never stored.
Problem solved.