diff --git a/application/controllers/Awards.php b/application/controllers/Awards.php
index 68e06755f..d01ba6415 100644
--- a/application/controllers/Awards.php
+++ b/application/controllers/Awards.php
@@ -276,8 +276,28 @@ class Awards extends CI_Controller
     {
         $this->load->model('logbook_model');
 
-        $gridsquare = str_replace('"', "", $this->security->xss_clean($this->input->post("Gridsquare")));
-        $band = str_replace('"', "", $this->security->xss_clean($this->input->post("Band")));
+        // Validate and sanitize gridsquare input - should be alphanumeric only, max 6 characters
+        $gridsquare_raw = $this->input->post("Gridsquare");
+        $band_raw = $this->input->post("Band");
+        
+        // Validate gridsquare format (should match standard grid square format)
+        if (!$gridsquare_raw || !preg_match('/^[A-Ra-r]{2}[0-9]{2}[A-Xa-x]{0,2}$/', $gridsquare_raw)) {
+            show_error('Invalid gridsquare format', 400);
+            return;
+        }
+        
+        // Validate band - use Cloudlog's band system for validation
+        $this->load->model('bands');
+        $valid_bands = array_keys($this->bands->bandslots);
+        $valid_bands[] = 'All'; // Add 'All' as a valid option
+        
+        if (!$band_raw || !in_array($band_raw, $valid_bands)) {
+            show_error('Invalid band specified', 400);
+            return;
+        }
+        
+        $gridsquare = strtoupper($gridsquare_raw);
+        $band = $band_raw;
         $data['results'] = $this->logbook_model->vucc_qso_details($gridsquare, $band);
 
         // Render Page
diff --git a/application/models/Logbook_model.php b/application/models/Logbook_model.php
index 5c087b617..25e20e677 100755
--- a/application/models/Logbook_model.php
+++ b/application/models/Logbook_model.php
@@ -556,23 +556,34 @@ class Logbook_model extends CI_Model
     $CI->load->model('logbooks_model');
     $logbooks_locations_array = $CI->logbooks_model->list_logbook_relationships($this->session->userdata('active_station_logbook'));
 
-    $location_list = "'" . implode("','", $logbooks_locations_array) . "'";
+    if (empty($logbooks_locations_array)) {
+      return $this->db->query("SELECT * FROM " . $this->config->item('table_name') . " WHERE 1=0"); // Return empty result
+    }
 
-    $sql = "select * from " . $this->config->item('table_name') .
-      " where station_id in (" . $location_list . ")" .
-      " and (col_gridsquare like '" . $gridsquare . "%'
-                    or col_vucc_grids like '%" . $gridsquare . "%')";
+    // Use parameterized query to prevent SQL injection
+    $this->db->select('*');
+    $this->db->from($this->config->item('table_name'));
+    $this->db->where_in('station_id', $logbooks_locations_array);
+    
+    // Use parameterized LIKE queries for gridsquare matching
+    $gridsquare_like = $gridsquare . '%';
+    $gridsquare_contains = '%' . $gridsquare . '%';
+    
+    $this->db->group_start();
+    $this->db->like('col_gridsquare', $gridsquare_like, 'after');
+    $this->db->or_like('col_vucc_grids', $gridsquare_contains);
+    $this->db->group_end();
 
     if ($band != 'All') {
       if ($band == 'SAT') {
-        $sql .= " and col_prop_mode ='" . $band . "'";
+        $this->db->where('col_prop_mode', $band);
       } else {
-        $sql .= " and col_prop_mode !='SAT'";
-        $sql .= " and col_band ='" . $band . "'";
+        $this->db->where('col_prop_mode !=', 'SAT');
+        $this->db->where('col_band', $band);
       }
     }
 
-    return $this->db->query($sql);
+    return $this->db->get();
   }
 
   public function activator_details($call, $band, $leogeo)