Fix SQL Injection Vulnerability

Per https://github.com/simpleinvoices/simpleinvoices/blob/master/modules/invoices/xml.php#L15-L16 it does just passes $_REQUEST vars to the class as $this->query and $this->qtype, which is then inserted directly into SQL query as is. This similar code seems to have been copied and pasted to multiple files.
Merge pull request #141 from KyraD/patch-4

Fix SQL Injection Vulnerability