Updated code to prevent sql injection and added ticket booking function

mysql_real_escape_string to prevent the sql injection

DoTentativeBooking($userid,$book_ticket,$from,$to,$date,$pnr,$seats,$email)
- does tentitive booking
Book ticket, cancel ticket function added