FIX SQL injection

Hi mate,

just a quick fix for 2 sql injections. I think this values are integer so intval is your best bet. If they are strings, mysql_real_escape_string is probably more appropriate.