Fix SQL injection threats and replace SESSION variable with api_get_user_id - refs #7272