Fix security issue

Sanitize user input before passing it to the SQL database.