Fixed a possible security issue that would have allowed HQL injection.