As hardburn pointed out, the code is fine. The query is parametrized, and therefore protected against (common) SQL injection. You can test if the statements are working by dumping the results of the query somewhere. Also, a 403 is returned by the web server. You can consult its logs to see what was passed.