Fix two potential SQL injection attack vectors

Alzabo is really awesome
Catch bad ids in paths

MySQL is treating these as numbers, not strings. MySQL is so awesome.