Fix SQL injection in project.php

Using user modified variables ($_GET, $_POST, $_REQUEST, $_FILES, some of $_SERVER, etc.) in SQL queries without first sanitizing them opens the door for SQL Injection, where a malicious user could potentially make undesired changes to the database or access private things.