Fix queues param SQL injection
Change destructive actions from GET to POST