url_handlers: Fix possible SQL injection attacks

Make sure that -

- any user input that is used in SQL queries as strings is run through
  make_mysql_safe_string().

- any form / post / get variables that are used in SQL queries as
  strings are run through make_mysql_safe_string(), this covers things
  which aren't directly user settable but which are set inside the page
  and a query could be crafted to override them.

- any variables pulled from the database that are then used in another
  query as strings have been run through make_mysql_safe_string() where
  they weren't under direct application control.

Signed-off-by: Andrew Clayton <andrew@dnsandmx.com>
utils: Tighten up the check in is_valid_ipv6_addr()

It was possible to enter a blank IP address, for example for the master
NS IP address due to is_valid_ipv6_addr succeeding even though
is_valid_ipv4_addr failed it.

Signed-off-by: Andrew Clayton <andrew@dnsandmx.com>