Corrected SQL against injection attacks