Converted a bunch of SQL queries to use PDO prepared statements.

Still plenty more to do.