Removed single quotes from queries before executing. Should resolve all security issues but XSS which should be handled by the fact that nothing is executed until user input is supplied.