Refactored q() to take a new optional $params array parameter.
Refactored controllers for SQL injection.
Checked remaining q() and findbyPk() function calls for SQL injection and corrected as necessary.
Checked and fixed SQL injection in findByAttributes() calls.