Mild fail on SQL injection but it doesn't return anything so I think it might be safe