Prepare statements for sql queries, use (int) to avoid nonint inputs

[foin137]

The goal of this edit is to prevent sql injection. For string inputs like player name -> prepare sql statements. For other inputs that are integers -> cast to int via (int)