close vulnerability holes

- use database class format_string to format all id vars
  in sql queries