diff --git project_issue_availability.module project_issue_availability.module
index 36bb5d4..845d978 100644
--- project_issue_availability.module
+++ project_issue_availability.module
@@ -205,11 +205,15 @@ function project_issue_availability_project_issue_assignees(&$assignees, $node)
   
   $q = 'SELECT cfg.uid FROM {project_issue_availability_user_config} cfg
           LEFT JOIN (SELECT COUNT(assigned) AS issue_count, assigned FROM {project_issues} ';
-  if (count($states)) $q .= 'WHERE sid IN (' . implode(',', $states) . ') ';          
+  if (count($states)) {
+    $q .= 'WHERE sid IN (' . db_placeholders($states) . ') ';
+    $args[] = $states;
+  }
   $q .= 'GROUP BY assigned) pi ON cfg.uid = pi.assigned 
           WHERE cfg.hiatus > %d OR pi.issue_count >= cfg.max';
+  $args[] = time();
           
-  $r = db_query($q, time());
+  $r = db_query($q, $args);
   
   while ($uid = db_result($r)) {
     _pia_unset($assignees, $node, $uid);
@@ -226,10 +230,9 @@ function project_issue_availability_project_issue_assignees(&$assignees, $node)
     
     // Unset assignees who have not selected the issue's terms
     if (count($tids)) {
-      $tids = implode(',', $tids);
       // This query assumes that users who have not selected any terms are
       // available for all issues.
-      $r = db_query("SELECT DISTINCT(uid) FROM {project_issue_availability_user_term} WHERE tid IN (%s)", $tids);
+      $r = db_query("SELECT DISTINCT(uid) FROM {project_issue_availability_user_term} WHERE tid IN (' . db_placeholders($tids) . ')", $tids);
       $valid_users = array();
       while ($uid = db_result($r)) {
         $valid_users[] = $uid;