Fix for possible SQL injection

Fixed a sql injection