fix sharing update, add proper escaping

fix for https://github.com/owncloud/core/issues/9863

cc @PVince81 @DeepDiver1975 @LukasReschke @craigpg @karlitschek 
As far I can see `$sublist` is an element of `$chunkedPermissionList` which in turn consists of `$updatedRows` which is casted to `int`. This should therefore not be injectable.

We might do this anyways to make this more clear and prevent such problems in the future.