#39 Security review of SQL calls

[Mark Wallis (aka serialmonkey)]

We need todo a review of all the SQL calls made from code and modules
to remove the issues with SQL injections that are caused by the way that
String concatenation is used to build up the queries.