use bind variables in SQL queries

looks like the previous PR (https://github.com/concrete5/concrete5/pull/760/) shouldn't have been closed.

Bug Tracker:
http://www.concrete5.org/developers/bugs/5-6-2-1/dashboardsitemap-deleting-fails-because-string-is-not-escaped/