Resolve Sql Injection Exploits

[leandrosardi]

• use ORM instead raw SQL where ever is possible.
• escape SQL values on dynamic query building.