Fix: possible sql-injection + placeholders-bug