New user rest APIs

SQL injection problem here.  Must use PARAM_INT and add the variable to the $params so the data binding is done in the DB layer.