Fix SQL Injection in subgenres.php

Using variables with user-provided content ($_GET, $_POST, $_REQUEST, $_FILES, $_COOKIE, some of $_SERVER, etc.) in SQL queries without first sanitizing them opens the door for SQL Injection, where a malicious user could potentially make undesired changes to the database or access private things.