Fix SQL Injection Query (Collection)