Fix SQL Injection BUG