Remove direct mysqli use

This replaces mysqli use with PDO hardcoded to mysql. The idea is to eventually support other DBMS, too.

There are some more bits hidden in there: removed some gettype() calls (replaced with is_string, as recommended by the docs), start to use prepared statements and bound parameters, instead of manual string escaping.