SQL-injection fix