diff --git a/code/modules/research/message_server.dm b/code/modules/research/message_server.dm
index 4b7ca85e7d4..f9d992b5489 100644
--- a/code/modules/research/message_server.dm
+++ b/code/modules/research/message_server.dm
@@ -184,9 +184,18 @@ var/obj/machinery/blackbox_recorder/blackbox
 
 		dbcon.Disconnect()
 
+// Sanitize inputs to avoid SQL injection attacks
+proc/sql_sanitize_text(var/text)
+	text = dd_replacetext(text, "'", "''")
+	text = dd_replacetext(text, ";", "")
+	text = dd_replacetext(text, "&", "")
+	return text
+
 proc/feedback_set(var/variable,var/value)
 	if(!blackbox) return
 
+	variable = sql_sanitize_text(variable)
+
 	var/datum/feedback_variable/FV = blackbox.find_feedback_datum(variable)
 
 	if(!FV) return
@@ -196,6 +205,8 @@ proc/feedback_set(var/variable,var/value)
 proc/feedback_inc(var/variable,var/value)
 	if(!blackbox) return
 
+	variable = sql_sanitize_text(variable)
+
 	var/datum/feedback_variable/FV = blackbox.find_feedback_datum(variable)
 
 	if(!FV) return
@@ -205,6 +216,8 @@ proc/feedback_inc(var/variable,var/value)
 proc/feedback_dec(var/variable,var/value)
 	if(!blackbox) return
 
+	variable = sql_sanitize_text(variable)
+
 	var/datum/feedback_variable/FV = blackbox.find_feedback_datum(variable)
 
 	if(!FV) return
@@ -214,6 +227,9 @@ proc/feedback_dec(var/variable,var/value)
 proc/feedback_set_details(var/variable,var/details)
 	if(!blackbox) return
 
+	variable = sql_sanitize_text(variable)
+	details = sql_sanitize_text(details)
+
 	var/datum/feedback_variable/FV = blackbox.find_feedback_datum(variable)
 
 	if(!FV) return