Sql injection fix

Used $wp->prepare to stop from having your plugin have an SQL injection vulnerability.

http://ottopress.com/2013/better-know-a-vulnerability-sql-injection/
https://codex.wordpress.org/Class_Reference/wpdb