Use prepared statement for query

This commit uses a prepared statement for the querying of the id. It's a bit cleaner and avoids the use of addslashes(). PDO does the preparing of the statements for databases that do not support it, so that should be OK. 

This commit changes the query to have an or for active=1 and active=true because sqlite does not support active=1 and returns not results.

This commit tests if $sth->fetch() succeeded before using the result as as array to prevent notices.