diff --git a/resources/install/scripts/app/fax/resources/scripts/hangup_rx.lua b/resources/install/scripts/app/fax/resources/scripts/hangup_rx.lua
index 990cc2ae7c..475b0da85d 100644
--- a/resources/install/scripts/app/fax/resources/scripts/hangup_rx.lua
+++ b/resources/install/scripts/app/fax/resources/scripts/hangup_rx.lua
@@ -32,8 +32,14 @@
 	require "resources.functions.config";
 
 --connect to the database
-	require "resources.functions.database_handle";
-	dbh = database_handle('system');
+	local Database = require "resources.functions.database_handle";
+	dbh = Database.new('system');
+
+--include json library
+	local json
+	if (debug["sql"]) then
+		json = require "resources.functions.lunajson"
+	end
 
 --define the explode function
 	require "resources.functions.explode";
@@ -58,8 +64,8 @@
 --get the domain_uuid using the domain name required for multi-tenant
 	if (domain_name ~= nil) then
 		sql = "SELECT domain_uuid FROM v_domains ";
-		sql = sql .. "WHERE domain_name = '" .. domain_name .. "' ";
-		status = dbh:query(sql, function(rows)
+		sql = sql .. "WHERE domain_name = :domain_name ";
+		dbh:query(sql, {domain_name = domain_name}, function(rows)
 			domain_uuid = rows["domain_uuid"];
 		end);
 	end
@@ -154,13 +160,14 @@
 	end
 
 --get the fax settings from the database
-	sql = [[SELECT * FROM v_fax
-		WHERE fax_uuid = ']] .. fax_uuid ..[['
-		AND domain_uuid = ']] .. domain_uuid ..[[']];
+	local sql = [[SELECT * FROM v_fax
+		WHERE fax_uuid = :fax_uuid
+		AND domain_uuid = :domain_uuid]];
+	local params = {fax_uuid = fax_uuid, domain_uuid = domain_uuid};
 	if (debug["sql"]) then
-		freeswitch.consoleLog("notice", "[fax] SQL: " .. sql .. "\n");
+		freeswitch.consoleLog("notice", "[fax] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 	end
-	status = dbh:query(sql, function(row)
+	dbh:query(sql, params, function(row)
 		dialplan_uuid = row["dialplan_uuid"];
 		fax_extension = row["fax_extension"];
 		fax_accountcode = row["accountcode"];
@@ -247,57 +254,72 @@
 	sql = sql .. ") ";
 	sql = sql .. "values ";
 	sql = sql .. "(";
-	sql = sql .. "'"..uuid.."', ";
-	sql = sql .. "'"..domain_uuid.."', ";
+	sql = sql .. ":uuid, ";
+	sql = sql .. ":domain_uuid, ";
 	if (fax_uuid ~= nil) then
-		sql = sql .. "'"..fax_uuid.."', ";
+		sql = sql .. ":fax_uuid, ";
 	end
-	sql = sql .. "'"..fax_success.."', ";
-	sql = sql .. "'"..fax_result_code .."', ";
-	sql = sql .. "'"..fax_result_text.."', ";
-	sql = sql .. "'"..fax_file.."', ";
+	sql = sql .. ":fax_success, ";
+	sql = sql .. ":fax_result_code, ";
+	sql = sql .. ":fax_result_text, ";
+	sql = sql .. ":fax_file, ";
 	if (fax_ecm_used ~= nil) then
-		sql = sql .. "'"..fax_ecm_used.."', ";
+		sql = sql .. ":fax_ecm_used, ";
 	end
 	if (fax_local_station_id ~= nil) then
-		sql = sql .. "'"..fax_local_station_id.."', ";
-	end
-	if (fax_document_transferred_pages == nil) then
-		sql = sql .. "'0', ";
-	else
-		sql = sql .. "'"..fax_document_transferred_pages.."', ";
-	end
-	if (fax_document_total_pages == nil) then
-		sql = sql .. "'0', ";
-	else
-		sql = sql .. "'"..fax_document_total_pages.."', ";
+		sql = sql .. ":fax_local_station_id, ";
 	end
+	sql = sql .. ":fax_document_transferred_pages, ";
+	sql = sql .. ":fax_document_total_pages, ";
 	if (fax_image_resolution ~= nil) then
-		sql = sql .. "'"..fax_image_resolution.."', ";
+		sql = sql .. ":fax_image_resolution, ";
 	end
 	if (fax_image_size ~= nil) then
-		sql = sql .. "'"..fax_image_size.."', ";
+		sql = sql .. ":fax_image_size, ";
 	end
 	if (fax_bad_rows ~= nil) then
-		sql = sql .. "'"..fax_bad_rows.."', ";
+		sql = sql .. ":fax_bad_rows, ";
 	end
 	if (fax_transfer_rate ~= nil) then
-		sql = sql .. "'"..fax_transfer_rate.."', ";
+		sql = sql .. ":fax_transfer_rate, ";
 	end
 	if (fax_uri ~= nil) then
-		sql = sql .. "'"..fax_uri.."', ";
+		sql = sql .. ":fax_uri, ";
 	end
 	if (database["type"] == "sqlite") then
-		sql = sql .. "'"..os.date("%Y-%m-%d %X").."', ";
+		sql = sql .. ":fax_date, ";
 	else
 		sql = sql .. "now(), ";
 	end
-	sql = sql .. "'"..os.time().."' ";
+	sql = sql .. ":fax_time ";
 	sql = sql .. ")";
+
+	local params = {
+		uuid = uuid;
+		domain_uuid = domain_uuid;
+		fax_uuid = fax_uuid;
+		fax_success = fax_success;
+		fax_result_code = fax_result_code;
+		fax_result_text = fax_result_text;
+		fax_file = fax_file;
+		fax_ecm_used = fax_ecm_used;
+		fax_local_station_id = fax_local_station_id;
+		fax_document_transferred_pages = fax_document_transferred_pages or '0';
+		fax_document_total_pages = fax_document_total_pages or '0';
+		fax_image_resolution = fax_image_resolution;
+		fax_image_size = fax_image_size;
+		fax_bad_rows = fax_bad_rows;
+		fax_transfer_rate = fax_transfer_rate;
+		fax_uri = fax_uri;
+		fax_date = os.date("%Y-%m-%d %X");
+		fax_time = os.time();
+	};
+
 	if (debug["sql"]) then
-		freeswitch.consoleLog("notice", "[fax] "..sql.."\n");
+		freeswitch.consoleLog("notice", "[fax] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 	end
-	dbh:query(sql);
+
+	dbh:query(sql, params);
 
 --add the fax files
 	if (fax_success ~= nil) then
@@ -333,39 +355,49 @@
 			table.insert(sql, ") ");
 			table.insert(sql, "values ");
 			table.insert(sql, "(");
-			table.insert(sql, "'" .. uuid .. "', ");
-			table.insert(sql, "'" .. fax_uuid .. "', ");
+			table.insert(sql, ":uuid, ");
+			table.insert(sql, ":fax_uuid, ");
 			table.insert(sql, "'rx', ");
 			table.insert(sql, "'tif', ");
-			table.insert(sql, "'" .. fax_file .. "', ");
+			table.insert(sql, ":fax_file, ");
 			if (caller_id_name ~= nil) then
-				table.insert(sql, "'" .. caller_id_name .. "', ");
+				table.insert(sql, ":caller_id_name, ");
 			end
 			if (caller_id_number ~= nil) then
-				table.insert(sql, "'" .. caller_id_number .. "', ");
+				table.insert(sql, ":caller_id_number, ");
 			end
 			if (database["type"] == "sqlite") then
-				table.insert(sql, "'"..os.date("%Y-%m-%d %X").."', ");
+				table.insert(sql, ":fax_date, ");
 			else
 				table.insert(sql, "now(), ");
 			end
-			table.insert(sql, "'" .. os.time() .. "', ");
+			table.insert(sql, ":fax_time, ");
 			if (storage_type == "base64") then
-				table.insert(sql, "'" .. fax_base64 .. "', ");
+				table.insert(sql, ":fax_base64, ");
 			end
-			table.insert(sql, "'" .. domain_uuid .. "'");
+			table.insert(sql, ":domain_uuid");
 			table.insert(sql, ")");
 			sql = table.concat(sql, "\n");
+			local params = {
+				uuid = uuid;
+				domain_uuid = domain_uuid;
+				fax_uuid = fax_uuid;
+				fax_file = fax_file;
+				caller_id_name = caller_id_name;
+				caller_id_number = caller_id_number;
+				fax_base64 = fax_base64;
+				fax_date = os.date("%Y-%m-%d %X");
+				fax_time = os.time();
+			};
 			if (debug["sql"]) then
-				freeswitch.consoleLog("notice", "[fax] SQL: " .. sql .. "\n");
+				freeswitch.consoleLog("notice", "[fax] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 			end
 			if (storage_type == "base64") then
-				local Database = require "resources.functions.database"
 				local dbh = Database.new('system', 'base64');
-				dbh:query(sql);
+				dbh:query(sql, params);
 				dbh:release();
 			else
-				result = dbh:query(sql);
+				result = dbh:query(sql, params);
 			end
 		end
 	end