fix sql injection

It's pretty obviously vulnerable, try requesting `api.cgi?method=get_album&album='"`

```
"error": "(1064, 'You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near \\'\\'\"\\n\\t\\torder by i_index asc\\n\\t\\tlimit 10\\n\\t\\toffset 0\\' at line 4')"}
```

As described in https://github.com/4pr0n/rip3/commit/e1cd7d63b5ac05f65e0e2382f54e8176dc5f8bdd