Prevent SQL injections using firstId parameter.

Howdy,

I was just looking at your project and noticed a potentially bad security bug.