Prepared statements

Uses PDO prepared statements to mitigate SQL injection. Includes user_zip -> user_location changes, but those could be reverted.