Escaping some db functions on model

Might or might not avoid SQL injections now.
Changing db to an object

Might avoid problems from many clients accessing at the same time.