diff --git resources/user_resource.inc resources/user_resource.inc
index 662edec..40266d7 100644
--- resources/user_resource.inc
+++ resources/user_resource.inc
@@ -65,7 +65,7 @@ function _user_resource_definition() {
           ),
         ),
       ),
-     
+
       'delete' => array(
         'help' => 'Deletes a user',
         'callback' => '_user_resource_delete',
@@ -174,11 +174,11 @@ function _user_resource_retrieve($uid) {
 /**
  * Create a new user.
  *
- * This function uses drupal_execute() and as such exepects all input to match 
+ * This function uses drupal_execute() and as such exepects all input to match
  * the submitting form in question.
  *
  * @param $account
- *   A object containing account information. The $account object should 
+ *   A object containing account information. The $account object should
  *   contain, at minimum, the following properties:
  *     - name (user name)
  *     - mail (email address)
@@ -190,8 +190,8 @@ function _user_resource_retrieve($uid) {
  *
  *  Roles can be passed in a roles property which is an associative
  *  array formatted with '<role id>' => '<role id>', not including
- *  the authenticated user role, which is given by default. 
- *  
+ *  the authenticated user role, which is given by default.
+ *
  * @return
  *   The user object of the newly created user.
  */
@@ -217,7 +217,7 @@ function _user_resource_create($account) {
     'pass2' => $account->pass,
   );
   $form_state['values']['op'] = t('Create new account');
-  
+
   $ret = drupal_execute('user_register', $form_state);
 
   // Error if needed.
@@ -232,7 +232,7 @@ function _user_resource_create($account) {
 /**
  * Update an existing user.
  *
- * This function uses drupal_execute() and as such exepects all input to match 
+ * This function uses drupal_execute() and as such exepects all input to match
  * the submitting form in question.
  *
  * @param $uid
@@ -267,7 +267,7 @@ function _user_resource_update($uid, $account) {
     $category = $account->category;
     unset($account->category);
   }
-  
+
   // Drop any passed in values into the $account var. Anything
   // unused by the form just gets ignored.
   foreach ($account as $key => $value) {
@@ -383,7 +383,7 @@ function _user_resource_logout() {
  * @param $page
  *   Page number of results to return (in pages of 20).
  * @param $fields
- *   The fields you want returned. 
+ *   The fields you want returned.
  * @param $parameters
  *   An array of fields and values used to build a sql WHERE clause indicating
  *   what items should be deleted.
@@ -394,7 +394,7 @@ function _user_resource_logout() {
  **/
 function _user_resource_index($page = 0, $fields = '*', $parameters = array()) {
   $parameters = (array) $parameters;
-  $schema = drupal_get_schema('node');
+  $schema = drupal_get_schema('users');
   $where = array();
   $fields = db_escape_string($fields);
 
@@ -402,15 +402,15 @@ function _user_resource_index($page = 0, $fields = '*', $parameters = array()) {
   if (!user_access('administer users')) {
     $parameters['active'] = 1;
   }
- 
+
   // Build an array of fields with the appropriate placeholders for use in
   // db_query().
   foreach ($parameters as $field => $value) {
-    $where[] = $field . ' = ' . db_type_placeholder($schema['fields'][$field]['type']);
+    $where[] = db_escape_string($field) . ' = ' . db_type_placeholder($schema['fields'][$field]['type']);
   }
 
   // Now implode that array into an actual WHERE clause.
-  $where = !empty($where) ? ' WHERE '. db_escape_string(implode(' AND ', $where)) : '';
+  $where = !empty($where) ? ' WHERE '. implode(' AND ', $where) : '';
   $sql = "SELECT $fields FROM {users} $where";
   $result = db_query_range($sql, $parameters, $page * 20, 20);
 
@@ -436,12 +436,12 @@ function _user_resource_access($op = 'view', $args = array()) {
         if(!$account->uid) {
           return services_error('That user ID does not exist', 406);
         }
-        return user_view_access($account);   
+        return user_view_access($account);
     case 'update':
         $account = user_load($args[1]->uid);
         if(!$account->uid) {
           return services_error('That user ID does not exist', 406);
-        }      
+        }
       return ($user->uid == $account->uid || user_access('administer users'));
     case 'create':
       return user_access('administer users');