Prevented SQL Injection

Hopefully prevented sql injection by adding prepare() and bindvalue()
functions.