Switch to parameterized queries to avoid SQL injection