Merge "Fix sql injection vulnerability"