currently there are many uses of 'vanilla' SQL. These should be migrated to PDO to make it future-proof (PHP 7+), and to make it more secure.