[BUGFIX] GetByType() SQL query errors

The entire query is no longer escaped. Instead, it is up to the user to escape any user-given input.
[CONF] Updated session variable name

Changed the session variable name to "XSRF" from the session ID.