db: fix potential SQL injection

mods/db/init.lua

@@ -68,19 +68,27 @@ assert(itb_db:exec[[
 db = {}
 
 function db.player_get_meta(name)
-  -- FIXME use http://luasqlite.luaforge.net/lsqlite3.html#db:prepare to prevent SQL injection
+	local stmt = itb_db:prepare[[
-	for row in itb_db:nrows("SELECT meta FROM player WHERE name = '" .. name .. "';") do
+		SELECT meta FROM player WHERE name = :name
+	]]
+	stmt:bind_names{name = name}
+	for row in stmt:nrows() do
+		stmt:finalize()
 		return minetest.parse_json(row.meta)
 	end
+	stmt:finalize()
 
 	print("no such player in db", name)
 	return nil
 end
 
 function db.player_put_meta(name, meta)
-  -- FIXME use http://luasqlite.luaforge.net/lsqlite3.html#db:prepare to prevent SQL injection
+	local stmt = itb_db:prepare[[
-	local r = itb_db:exec("REPLACE INTO player_meta (name, meta) VALUES ('" .. name .. "', '" ..
+		REPLACE INTO player_meta (name, meta) VALUES (:name, :meta)
-		minetest.write_json(meta) .. "');")
+	]]
+	stmt:bind_names{name = name, meta = minetest.write_json(meta)}
+	local r = stmt:step()
+	stmt:finalize()
 	if not r then
 		print("error writing")
 		return false