Fixing SQL injection attacks