Fix SQL Injection Vulnerability

POST params are being put into SQL query and not being binded. This patch makes placeholders for them and runs separate query with them if condition met.
Merge pull request #139 from KyraD/patch-2

Fix SQL Injection Vulnerability