fix sqli

it's not sanitizing inputs, the easiest to exploit is in ajax.php:
./sqlmap.py -u "http://localhost/bitid-php/ajax.php" -p nonce --dbms=mysql --data="nonce=asdf" --technique=T --level 5