SQL sanitization or migrate to an ORM

I really should have used an object relational mapping library (ORM) from the start, which would have this built in, but as mentioned on forum, I was just trying to hack something together at first.

Not a super big deal since it’s self-hosted and there’s authentication on the API, but still shouldn’t ignore SQL injection.