Replacing queries would prepared statements to avoid SQL injection.

I replaced the queries with the prepared statements whenever possible (for query variables and inputs). This is to avoid SQL injection.