Validating $userID, prevent injections

because we don't trust any input that could have come from a user
(avoiding SQL injections)