Use mysql_real_escape_string and prepared statement

Replaced depricated mysql_escape_string with mysql_real_escape_string.
Use of Prepared Statments to prevent SQL-Injections
Userpermissions with prepared Statments
Merge pull request #5 from voxel01/prevent-SQL-injection

Prevent sql injection