Fix MySQL injection vulnerability