Add Surgery Event

Should now have protection against SQL injection.