Fix sql injection vulnerabilities