diff --git a/core/authentication/resources/classes/plugins/database.php b/core/authentication/resources/classes/plugins/database.php
index 36fc95d98c..19637f5551 100644
--- a/core/authentication/resources/classes/plugins/database.php
+++ b/core/authentication/resources/classes/plugins/database.php
@@ -288,19 +288,19 @@ class plugin_database {
 
 						//get the user contact details
 							if ($contacts_exists) {
+								unset($parameters);
 								$sql = "select ";
 								$sql .= " c.contact_organization, ";
 								$sql .= " c.contact_name_given, ";
 								$sql .= " c.contact_name_family, ";
-								$sql .= " a.contact_attachment_uuid, ";
+								$sql .= " a.contact_attachment_uuid ";
 								$sql .= "from v_contacts as c ";
-								$sql .= "where contact_uuid = :contact_uuid ";
-								$sql .= "left join v_contact_attachments as a ";
-								$sql .= " on c.contact_uuid = a.contact_uuid ";
+								$sql .= "left join v_contact_attachments as a on c.contact_uuid = a.contact_uuid ";
+								$sql .= "where c.contact_uuid = :contact_uuid ";
+								$sql .= "and c.domain_uuid = :domain_uuid ";
 								$sql .= "and a.attachment_primary = true ";
 								$sql .= "and a.attachment_filename is not null ";
 								$sql .= "and a.attachment_content is not null ";
-								$sql .= "and c.domain_uuid = :domain_uuid ";
 								$parameters['domain_uuid'] = $this->domain_uuid;
 								$parameters['contact_uuid'] = $this->contact_uuid;
 								$contact = $settings->database()->select($sql, $parameters, 'row');