diff --git a/main.py b/main.py
index 98039cd..a5edf15 100644
--- a/main.py
+++ b/main.py
@@ -129,7 +129,7 @@ def adduser():
         c.execute("INSERT or IGNORE INTO users (username, balance) VALUES (?, 0)", [username])
         conn.commit()
         socketio.emit("update", "update")
-        c.execute(f"SELECT * FROM users WHERE username={username}")
+        c.execute(f"SELECT * FROM users WHERE username=?", [username])
         user = c.fetchall()[0]
         db_log(f"Added user id: {user[0]} name: {user[2]}")
         return 'Added user <a href="/list">user and tag list</a>'