Fix SQL injection

Passing variables straight to the database without using prepared
statements is a bad idea.