Good point, but for something done in 3 days I didn't want to risk having left some SQL injection somewhere somehow and leaking people's email.

But yes that's a good idea.