Fixed possible SQL injection

The raw $project_id given by the user was used in one of the queries.
Make sure it is always interpreted as a number.

Problem found by Ablu.