Separate frontend Ajax calls from backend Ajax calls
Move to mysqli prepared statements

To avoid MySQL injections and to use the new API