diff --git a/honeypot/store/postgres.go b/honeypot/store/postgres.go
index 88a2b2c..756aea8 100644
--- a/honeypot/store/postgres.go
+++ b/honeypot/store/postgres.go
@@ -161,6 +161,7 @@ func (s *PostgresStore) statsTotal(limit int) ([]StatsResult, error) {
 
 func (s *PostgresStore) Query(query AttemptQuery) ([]models.LoginAttempt, error) {
 	var stmt string
+	queryString := query.Query
 
 	switch query.QueryType {
 	case AttemptQueryTypeIP:
@@ -168,15 +169,17 @@ func (s *PostgresStore) Query(query AttemptQuery) ([]models.LoginAttempt, error)
 					FROM login_attempts WHERE remote_ip = $1`
 	case AttemptQueryTypePassword:
 		stmt = `SELECT id, date, remote_ip, username, password, client_version, connection_uuid, country
-					FROM login_attempts WHERE password like '%$1%'`
+					FROM login_attempts WHERE password like $1`
+		queryString = fmt.Sprintf("%%%s%%", queryString)
 	case AttemptQueryTypeUsername:
 		stmt = `SELECT id, date, remote_ip, username, password, client_version, connection_uuid, country
-					FROM login_attempts WHERE username like '%$1%'`
+					FROM login_attempts WHERE username like $1`
+		queryString = fmt.Sprintf("%%%s%%", queryString)
 	default:
 		return nil, fmt.Errorf("Invalid query type")
 	}
 
-	rows, err := s.db.Query(stmt, query.Query)
+	rows, err := s.db.Query(stmt, queryString)
 	if err != nil {
 		return nil, fmt.Errorf("Unable to query database: %w", err)
 	}