Update admin_action.php

Fixed quite a few SQL injections, I suggest using PDO (Prepared Statements) instead of how your doing it now as it has built in sanitation.