Session and security with prepared statements.

And always getting things by primary key.