SQL Injection Fix

Find SQL built by string concatenation and move it to parameterised queries.

• find
• security