fix sharing update, add proper escaping

fix for https://github.com/owncloud/core/issues/9863

cc @PVince81 @DeepDiver1975 @LukasReschke @craigpg @karlitschek 
I don't think $connection->quote($connection, \PDO::PARAM_INT) will produce a string containing quotes. It should produce something like string(4) "1234" which is an integer in SQL world (no quotes in the string).