Change sqli queries to prepared stmts, fixed some bugs