diff --git a/resources/install/scripts/app/voicemail/resources/functions/delete_recording.lua b/resources/install/scripts/app/voicemail/resources/functions/delete_recording.lua
index db4bd10135..da50805eb3 100644
--- a/resources/install/scripts/app/voicemail/resources/functions/delete_recording.lua
+++ b/resources/install/scripts/app/voicemail/resources/functions/delete_recording.lua
@@ -32,11 +32,13 @@
 					macro(session, "message_deleted", 1, 100, '');
 				end
 			end
+
 		--get the voicemail_uuid
-			sql = [[SELECT * FROM v_voicemails
-				WHERE domain_uuid = ']] .. domain_uuid ..[['
-				AND voicemail_id = ']] .. voicemail_id ..[[']];
-			status = dbh:query(sql, function(row)
+			local sql = [[SELECT * FROM v_voicemails
+				WHERE domain_uuid = :domain_uuid
+				AND voicemail_id = :voicemail_id]];
+			local params = {domain_uuid = domain_uuid, voicemail_id = voicemail_id};
+			dbh:query(sql, params, function(row)
 				db_voicemail_uuid = row["voicemail_uuid"];
 			end);
 		--flush dtmf digits from the input buffer
@@ -46,13 +48,14 @@
 			os.remove(voicemail_dir.."/"..voicemail_id.."/msg_"..uuid.."."..vm_message_ext);
 		--delete from the database
 			sql = [[DELETE FROM v_voicemail_messages
-				WHERE domain_uuid = ']] .. domain_uuid ..[['
-				AND voicemail_uuid = ']] .. db_voicemail_uuid ..[['
-				AND voicemail_message_uuid = ']] .. uuid ..[[']];
+				WHERE domain_uuid = :domain_uuid
+				AND voicemail_uuid = :voicemail_uuid
+				AND voicemail_message_uuid = :uuid]];
+			params = {domain_uuid = domain_uuid, voicemail_uuid = db_voicemail_uuid, uuid = uuid};
 			if (debug["sql"]) then
-				freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
+				freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 			end
-			dbh:query(sql);
+			dbh:query(sql, params);
 		--log to console
 			if (debug["info"]) then
 				freeswitch.consoleLog("notice", "[voicemail][deleted] message: " .. uuid .. "\n");