SQL injection precautions + statistics bug fix

Should now be guarded from SQL injection. Fixed a bug with user
statistics not generating properly by putting the @id tag to language as
the id has to be unique.