Fix sql injection oops