Fix sql injection vulnerability

Note that the dimension list cannot have any whitespace after the comma.

Change-Id: I6b5d4d572630252c393ff92b2b3cac5a8c21b56b