Added validation for contact adding and changed use of prepared statements to avoid SQL injection.