diff --git a/server/local-auth.mjs b/server/local-auth.mjs
index c5508c9..c3204e0 100644
--- a/server/local-auth.mjs
+++ b/server/local-auth.mjs
@@ -172,17 +172,19 @@ export function createLocalUserAuth(pool) {
     }
     const where = clauses.length ? `WHERE ${clauses.join(' AND ')}` : '';
     const [[countRow]] = await pool.execute(`SELECT COUNT(*) AS total FROM auth_users ${where}`, params);
-    const offset = (Math.max(page, 1) - 1) * Math.max(pageSize, 1);
+    const safePage = Math.max(Number(page) || 1, 1);
+    const safePageSize = Math.max(Number(pageSize) || 20, 1);
+    const offset = (safePage - 1) * safePageSize;
     const [rows] = await pool.execute(
-      `SELECT * FROM auth_users ${where} ORDER BY id DESC LIMIT ? OFFSET ?`,
-      [...params, Math.max(pageSize, 1), offset],
+      `SELECT * FROM auth_users ${where} ORDER BY id DESC LIMIT ${safePageSize} OFFSET ${offset}`,
+      params,
     );
     return {
       items: rows.map((row) => rowToUser(row)),
       total: Number(countRow.total ?? 0),
-      page,
-      pageSize,
-      totalPages: Math.max(1, Math.ceil(Number(countRow.total ?? 0) / pageSize)),
+      page: safePage,
+      pageSize: safePageSize,
+      totalPages: Math.max(1, Math.ceil(Number(countRow.total ?? 0) / safePageSize)),
     };
   }