Fix access restrictions on adding students

Also, fix an SQL injection vuln.