ported installer to PDO

and started porting over SELECT statements to use prepared statements,
too