Replace all the addslashes with parameterised queries, and attempt to spot anywhere else that failed to escape queries properly