[FIX] bin/osv/*: avoid (potential) sql injections