diff --git a/app/call_centers/call_center_queues.php b/app/call_centers/call_center_queues.php
index 2b822c006f..b24e041bff 100644
--- a/app/call_centers/call_center_queues.php
+++ b/app/call_centers/call_center_queues.php
@@ -51,6 +51,21 @@
 	$order_by = $_GET["order_by"];
 	$order = $_GET["order"];
 
+//validate order by
+	if (strlen($order_by) > 0) {
+		$order_by = preg_replace('#[^a-zA-Z0-9_\-]#', '', $order_by);
+	}
+
+//validate the order
+	switch ($order) {
+		case 'asc':
+			break;
+		case 'desc':
+			break;
+		default:
+			$order = '';
+	}
+
 //show the content
 	echo "<table width='100%' cellpadding='0' cellspacing='0' border='0'>\n";
 	echo "<tr>\n";
@@ -70,14 +85,11 @@
 	echo "</tr></table>\n";
 
 	//get total call center queues count from the database
-		$sql = "select count(*) as num_rows from v_call_center_queues where domain_uuid = '".$_SESSION['domain_uuid']."' ";
-		$prep_statement = $db->prepare($sql);
-		if ($prep_statement) {
-			$prep_statement->execute();
-			$row = $prep_statement->fetch(PDO::FETCH_ASSOC);
-			$total_call_center_queues = $row['num_rows'];
-		}
-		unset($prep_statement, $row);
+		$sql = "select count(*) as num_rows from v_call_center_queues where domain_uuid = :domain_uuid ";
+		$database = new database;
+		$parameters['domain_uuid'] = $_SESSION['domain_uuid'];
+		$row = $database->select($sql, $parameters, 'all');
+		$total_call_center_queues = $row['num_rows'];
 
 	//prepare to page the results (reuse $sql from above)
 		if (strlen($order_by) == 0) {
@@ -87,12 +99,10 @@
 		else {
 			$sql .= "order by $order_by $order ";
 		}
-		$prep_statement = $db->prepare(check_sql($sql));
-		$prep_statement->execute();
-		$result = $prep_statement->fetchAll(PDO::FETCH_NAMED);
-		$num_rows = count($result);
-		unset ($prep_statement, $result, $sql);
-
+		$database = new database;
+		$result = $database->select($sql, $parameters, 'all');
+		$num_rows = $database->select($sql, $parameters, 'column');
+		
 		$rows_per_page = ($_SESSION['domain']['paging']['numeric'] != '') ? $_SESSION['domain']['paging']['numeric'] : 50;
 		$param = "";
 		$page = $_GET['page'];
@@ -101,7 +111,7 @@
 		$offset = $rows_per_page * $page;
 
 		$sql = "select * from v_call_center_queues ";
-		$sql .= "where domain_uuid = '$domain_uuid' ";
+		$sql .= "where domain_uuid = :domain_uuid ";
 		if (strlen($order_by) == 0) {
 			$order_by = 'queue_name';
 			$order = 'asc';
@@ -109,13 +119,12 @@
 		else {
 			$sql .= "order by $order_by $order ";
 		}
-		$sql .= " limit $rows_per_page offset $offset ";
-		$prep_statement = $db->prepare(check_sql($sql));
-		$prep_statement->execute();
-		$result = $prep_statement->fetchAll(PDO::FETCH_NAMED);
-		$result_count = count($result);
-		unset ($prep_statement, $sql);
-
+		$sql .= " limit :rows_per_page offset :offset ";
+		$database = new database;
+		$parameters['rows_per_page'] = $rows_per_page;
+		$parameters['offset'] = $offset;
+		$result = $database->select($sql, $parameters, 'all');
+		
 	$c = 0;
 	$row_style["0"] = "row_style0";
 	$row_style["1"] = "row_style1";
@@ -146,7 +155,7 @@
 	echo "</td>\n";
 	echo "</tr>\n";
 
-	if ($result_count > 0) {
+	if (is_array($result)) {
 		foreach($result as $row) {
 			$tr_link = (permission_exists('call_center_queue_edit')) ? "href='call_center_queue_edit.php?id=".escape($row[call_center_queue_uuid])."'" : null;
 			echo "<tr ".$tr_link.">\n";