fix SQL-injection

https://github.com/Mark-H/EvoGallery/pull/59