diff --git a/routes/schools.js b/routes/schools.js
index 28a46f0..315c10c 100644
--- a/routes/schools.js
+++ b/routes/schools.js
@@ -34,7 +34,7 @@ const getSchools = () => {
 const getSchool = (id) => {
     let getSchoolPromise = new Promise((resolve, reject) => {
 
-        let query = "SELECT * FROM school WHERE id = " + id
+        let query = "SELECT * FROM school WHERE id = " + db.escapeId(id)
 
         db.query(query, async (err, result) => {
             if (err) return reject
@@ -100,7 +100,7 @@ const buildSchool = async (school) => {
         let query =
         "SELECT ms.id, ms.name " +
         "FROM meta_school AS ms " +
-        "WHERE ms.id = " + school.id_meta_school
+        "WHERE ms.id = " + db.escapeId(school.id_meta_school)
 
         db.query(query, (err, result) => {
             if (err) return reject
diff --git a/routes/spells.js b/routes/spells.js
index 9e4a0a5..b9ee3a9 100644
--- a/routes/spells.js
+++ b/routes/spells.js
@@ -34,7 +34,7 @@ const getSpells = () => {
 const getSpell = (id) => {
     let getSpellPromise = new Promise((resolve, reject) => {
 
-        let query = "SELECT * FROM spell WHERE id = " + id
+        let query = "SELECT * FROM spell WHERE id = " + db.escapeId(id)
 
         db.query(query, async (err, result) => {
             if (err) return reject
@@ -152,7 +152,7 @@ const buildSpell = async (spell) => {
         "SELECT school.id, school.name " +
         "FROM spells_schools AS sc " +
         "INNER JOIN school AS school ON sc.id_school = school.id " +
-        "WHERE sc.id_spell = " + spell.id
+        "WHERE sc.id_spell = " + db.escapeId(spell.id)
 
         db.query(query, (err, result) => {
             if (err) return reject
@@ -166,7 +166,7 @@ const buildSpell = async (spell) => {
         "SELECT variable.id, variable.description " +
         "FROM spells_variables AS sv " +
         "INNER JOIN variable AS variable ON sv.id_variable = variable.id " +
-        "WHERE sv.id_spell = " + spell.id
+        "WHERE sv.id_spell = " + db.escapeId(spell.id)
 
         db.query(query, (err, result) => {
             if (err) return reject
@@ -180,7 +180,7 @@ const buildSpell = async (spell) => {
         "SELECT ingredient.id, ingredient.name " +
         "FROM spells_ingredients AS si " +
         "INNER JOIN ingredient AS ingredient ON si.id_ingredient = ingredient.id " +
-        "WHERE si.id_spell = " + spell.id
+        "WHERE si.id_spell = " + db.escapeId(spell.id)
 
         db.query(query, (err, result) => {
             if (err) return reject