diff --git a/src/article_del.c b/src/article_del.c
index 5fbb09d..456a1a7 100644
--- a/src/article_del.c
+++ b/src/article_del.c
@@ -80,7 +80,7 @@ int article_del(const SECTION_LIST *p_section, const ARTICLE *p_article)
 	db = db_open();
 	if (db == NULL)
 	{
-		log_error("db_open() error: %s", mysql_error(db));
+		log_error("db_open() error");
 		ret = -1;
 		goto cleanup;
 	}
diff --git a/src/article_op.c b/src/article_op.c
index d511fae..1e1408b 100644
--- a/src/article_op.c
+++ b/src/article_op.c
@@ -59,7 +59,7 @@ int article_excerption_set(SECTION_LIST *p_section, int32_t aid, int8_t set)
 	db = db_open();
 	if (db == NULL)
 	{
-		log_error("db_open() error: %s", mysql_error(db));
+		log_error("db_open() error");
 		ret = -1;
 		goto cleanup;
 	}
diff --git a/src/article_post.c b/src/article_post.c
index c3d8b71..c9e1e65 100644
--- a/src/article_post.c
+++ b/src/article_post.c
@@ -247,7 +247,7 @@ int article_post(const SECTION_LIST *p_section, ARTICLE *p_article_new)
 	db = db_open();
 	if (db == NULL)
 	{
-		log_error("db_open() error: %s", mysql_error(db));
+		log_error("db_open() error");
 		ret = -1;
 		goto cleanup;
 	}
@@ -470,7 +470,7 @@ int article_modify(const SECTION_LIST *p_section, const ARTICLE *p_article, ARTI
 	db = db_open();
 	if (db == NULL)
 	{
-		log_error("db_open() error: %s", mysql_error(db));
+		log_error("db_open() error");
 		ret = -1;
 		goto cleanup;
 	}
@@ -619,7 +619,7 @@ int article_modify(const SECTION_LIST *p_section, const ARTICLE *p_article, ARTI
 	db = db_open();
 	if (db == NULL)
 	{
-		log_error("db_open() error: %s", mysql_error(db));
+		log_error("db_open() error");
 		ret = -1;
 		goto cleanup;
 	}
@@ -801,7 +801,7 @@ int article_reply(const SECTION_LIST *p_section, const ARTICLE *p_article, ARTIC
 	db = db_open();
 	if (db == NULL)
 	{
-		log_error("db_open() error: %s", mysql_error(db));
+		log_error("db_open() error");
 		ret = -1;
 		goto cleanup;
 	}
@@ -1109,7 +1109,7 @@ int article_reply(const SECTION_LIST *p_section, const ARTICLE *p_article, ARTIC
 	db = db_open();
 	if (db == NULL)
 	{
-		log_error("db_open() error: %s", mysql_error(db));
+		log_error("db_open() error");
 		ret = -1;
 		goto cleanup;
 	}
diff --git a/src/login.c b/src/login.c
index d4daba6..92c732d 100644
--- a/src/login.c
+++ b/src/login.c
@@ -115,6 +115,8 @@ int check_user(const char *username, const char *password)
 	int i;
 	int ok = 1;
 	char user_tz_env[BBS_user_tz_max_len + 2];
+	char username_f[BBS_username_max_len * 2 + 1];
+	char password_f[BBS_password_max_len * 2 + 1];
 
 	db = db_open();
 	if (db == NULL)
@@ -154,6 +156,10 @@ int check_user(const char *username, const char *password)
 		goto cleanup;
 	}
 
+	// Secure SQL parameters
+	mysql_real_escape_string(db, username_f, username, (unsigned long)strnlen(username, sizeof(username)));
+	mysql_real_escape_string(db, password_f, password, (unsigned long)strnlen(password, sizeof(password)));
+
 	// Begin transaction
 	if (mysql_query(db, "SET autocommit=0") != 0)
 	{
@@ -211,7 +217,7 @@ int check_user(const char *username, const char *password)
 			 "WHERE user_err_login_log.username = '%s' "
 			 "AND (user_err_login_log.login_dt >= user_pubinfo.last_login_dt "
 			 "OR user_pubinfo.last_login_dt IS NULL)",
-			 username);
+			 username_f);
 	if (mysql_query(db, sql) != 0)
 	{
 		log_error("Query user_list error: %s", mysql_error(db));
@@ -239,7 +245,7 @@ int check_user(const char *username, const char *password)
 	snprintf(sql, sizeof(sql),
 			 "SELECT UID, username, p_login FROM user_list "
 			 "WHERE username = '%s' AND password = SHA2('%s', 256) AND enable",
-			 username, password);
+			 username_f, password_f);
 	if (mysql_query(db, sql) != 0)
 	{
 		log_error("Query user_list error: %s", mysql_error(db));
@@ -297,7 +303,7 @@ int check_user(const char *username, const char *password)
 		snprintf(sql, sizeof(sql),
 				 "INSERT INTO user_err_login_log(username, password, login_dt, login_ip) "
 				 "VALUES('%s', '%s', NOW(), '%s')",
-				 username, password, hostaddr_client);
+				 username_f, password_f, hostaddr_client);
 		if (mysql_query(db, sql) != 0)
 		{
 			log_error("Insert into user_err_login_log error: %s", mysql_error(db));
@@ -603,7 +609,7 @@ int user_online_update(const char *action)
 	db = db_open();
 	if (db == NULL)
 	{
-		log_error("db_open() error: %s", mysql_error(db));
+		log_error("db_open() error");
 		return -1;
 	}
 
diff --git a/src/main.c b/src/main.c
index 9e80480..34b8090 100644
--- a/src/main.c
+++ b/src/main.c
@@ -523,7 +523,7 @@ int main(int argc, char *argv[])
 	}
 	if (unlink(VAR_USER_LIST_SHM) < 0)
 	{
-		log_error("unlink(%s) error", VAR_SECTION_LIST_SHM);
+		log_error("unlink(%s) error", VAR_USER_LIST_SHM);
 	}
 
 	log_common("Main process exit normally");
diff --git a/src/section_list_loader.c b/src/section_list_loader.c
index 67acf5a..2defe18 100644
--- a/src/section_list_loader.c
+++ b/src/section_list_loader.c
@@ -54,7 +54,7 @@ int load_section_config_from_db(int update_gen_ex)
 	db = db_open();
 	if (db == NULL)
 	{
-		log_error("db_open() error: %s", mysql_error(db));
+		log_error("db_open() error");
 		ret = -1;
 		goto cleanup;
 	}
@@ -208,7 +208,7 @@ int append_articles_from_db(int32_t start_aid, int global_lock, int article_coun
 	db = db_open();
 	if (db == NULL)
 	{
-		log_error("db_open() error: %s", mysql_error(db));
+		log_error("db_open() error");
 		ret = -1;
 		goto cleanup;
 	}
@@ -367,7 +367,7 @@ int set_last_article_op_log_from_db(void)
 	db = db_open();
 	if (db == NULL)
 	{
-		log_error("db_open() error: %s", mysql_error(db));
+		log_error("db_open() error");
 		ret = -1;
 		goto cleanup;
 	}
@@ -418,7 +418,7 @@ int apply_article_op_log_from_db(int op_count_limit)
 	db = db_open();
 	if (db == NULL)
 	{
-		log_error("db_open() error: %s", mysql_error(db));
+		log_error("db_open() error");
 		ret = -1;
 		goto cleanup;
 	}
diff --git a/src/user_info_update.c b/src/user_info_update.c
index e7e3e35..79c2649 100644
--- a/src/user_info_update.c
+++ b/src/user_info_update.c
@@ -53,7 +53,7 @@ int user_intro_edit(int uid)
 	db = db_open();
 	if (db == NULL)
 	{
-		log_error("db_open() error: %s", mysql_error(db));
+		log_error("db_open() error");
 		ret = -1;
 		goto cleanup;
 	}
@@ -154,7 +154,7 @@ int user_intro_edit(int uid)
 	db = db_open();
 	if (db == NULL)
 	{
-		log_error("db_open() error: %s", mysql_error(db));
+		log_error("db_open() error");
 		ret = -1;
 		goto cleanup;
 	}
@@ -222,7 +222,7 @@ int user_sign_edit(int uid)
 	db = db_open();
 	if (db == NULL)
 	{
-		log_error("db_open() error: %s", mysql_error(db));
+		log_error("db_open() error");
 		ret = -1;
 		goto cleanup;
 	}
@@ -324,7 +324,7 @@ int user_sign_edit(int uid)
 	db = db_open();
 	if (db == NULL)
 	{
-		log_error("db_open() error: %s", mysql_error(db));
+		log_error("db_open() error");
 		ret = -1;
 		goto cleanup;
 	}
diff --git a/src/user_list.c b/src/user_list.c
index 9af3281..be15e85 100644
--- a/src/user_list.c
+++ b/src/user_list.c
@@ -608,7 +608,7 @@ int user_list_pool_reload(int online_user)
 	db = db_open();
 	if (db == NULL)
 	{
-		log_error("db_open() error: %s", mysql_error(db));
+		log_error("db_open() error");
 		return -1;
 	}