fairly small security enhancement to avoid SQL injection at least for the session handler (using deprecated PHP method...)