SQL injection prevention - messages

Added SQL injection prevention to existing message queries.
New method escapeQuery() added to allow treatment of a variable before
adding to query.