Same here:

```
mysql_real_escape_string($userId)
```

Let's start another task for DB code cleanup?