(SQL Injection) Use ORM model to retrieve user so that framework handles injection protection