Replace mysql_real_escape_string with PDO prepared statements.
Remove code which has been commented out since 2010

This is in the git history in case anyone needs to refer to it.
Remove more long commented-out code that uses non-parameterized SQL
Modify how insert IDs are retrieved to sanity check they are numbers, and cast accordingly.
Remove redundant variable declarations.
Reinstate fatal database error message, rather than debug output.