Added calls to EscapeChars() to avoid more SQL injections and added static and non-static calls to the BEs