Prevent SQL injections using firstId parameter.