Fixed some SQL injections, migrated to PDO