security fixes

chg: pdo-Stored Prozedures
fix: Missing Entity language Strings
fix: CrossScripting on Playerpage