Use model to create new transaction instead of direct core_resource access

Direct inserts without placeholders are vulnerable to MySQL injection