diff --git a/resources/install/scripts/app/voicemail/resources/functions/main_menu.lua b/resources/install/scripts/app/voicemail/resources/functions/main_menu.lua
index f6ed58221c..8b5a40b1c6 100644
--- a/resources/install/scripts/app/voicemail/resources/functions/main_menu.lua
+++ b/resources/install/scripts/app/voicemail/resources/functions/main_menu.lua
@@ -32,14 +32,15 @@
 				session:flushDigits();
 			--new voicemail count
 				if (session:ready()) then
-					sql = [[SELECT count(*) as new_messages FROM v_voicemail_messages
-						WHERE domain_uuid = ']] .. domain_uuid ..[['
-						AND voicemail_uuid = ']] .. voicemail_uuid ..[['
+					local sql = [[SELECT count(*) as new_messages FROM v_voicemail_messages
+						WHERE domain_uuid = :domain_uuid
+						AND voicemail_uuid = :voicemail_uuid
 						AND (message_status is null or message_status = '') ]];
-						if (debug["sql"]) then
-							freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
-						end
-					status = dbh:query(sql, function(row)
+					local params = {domain_uuid = domain_uuid, voicemail_uuid = voicemail_uuid};
+					if (debug["sql"]) then
+						freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
+					end
+					dbh:query(sql, params, function(row)
 						new_messages = row["new_messages"];
 					end);
 					dtmf_digits = macro(session, "new_messages", 1, 100, new_messages);
@@ -48,32 +49,34 @@
 				if (session:ready()) then
 					if (string.len(dtmf_digits) == 0) then
 						sql = [[SELECT count(*) as saved_messages FROM v_voicemail_messages
-							WHERE domain_uuid = ']] .. domain_uuid ..[['
-							AND voicemail_uuid = ']] .. voicemail_uuid ..[['
+							WHERE domain_uuid = :domain_uuid
+							AND voicemail_uuid = :voicemail_uuid
 							AND message_status = 'saved' ]];
-							if (debug["sql"]) then
-								freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
-							end
-						status = dbh:query(sql, function(row)
+						local params = {domain_uuid = domain_uuid, voicemail_uuid = voicemail_uuid};
+						if (debug["sql"]) then
+							freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
+						end
+						dbh:query(sql, params, function(row)
 							saved_messages = row["saved_messages"];
 						end);
 						dtmf_digits = macro(session, "saved_messages", 1, 100, saved_messages);
 					end
 				end
-            --get domain timezone
-                if (session:ready()) then
-                    if (string.len(dtmf_digits) == 0) then
-                        sql = [[SELECT domain_setting_value as current_time_zone FROM v_domain_settings
-							WHERE domain_uuid = ']] .. domain_uuid ..[['
-                            AND domain_setting_subcategory='time_zone' ]];
-                            if (debug["sql"]) then
-                                freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
-                            end
-                        status = dbh:query(sql, function(row)
-                            current_time_zone = row["current_time_zone"];
-                        end);
-                    end
-                end
+			--get domain timezone
+				if (session:ready()) then
+					if (string.len(dtmf_digits) == 0) then
+						local sql = [[SELECT domain_setting_value as current_time_zone FROM v_domain_settings
+							WHERE domain_uuid = :domain_uuid
+							AND domain_setting_subcategory='time_zone' ]];
+						local params = {domain_uuid = domain_uuid};
+						if (debug["sql"]) then
+							freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
+						end
+						dbh:query(sql, params, function(row)
+							current_time_zone = row["current_time_zone"];
+						end);
+					end
+				end
 			--to listen to new message
 				if (session:ready() and new_messages ~= '0') then
 					if (string.len(dtmf_digits) == 0) then