SQL-query patch

Hey,

i made a little patch where i changed your sql query.
I did put the %s in single quotes, something the coder module advised to prevent sql injection.
Just that... :)

grtz,
tom