Updated 404 and started on a security-vetting

Security-vetting: removing all use of non-prepared statements for
db-lookups etc.
Added get_post.php for the edit-box, still a WIP