Fix sql injection vulnerability