replace mysql_query calls with pdo

There are a couple of injection-vulnerable mysql_query calls for some reason. I replaced them with PDO.