Fix security bugs

[rgooler]

I was interested in using this code, but upon quick review, I noticed that there was insufficient protection against SQL and JSON injection. So I made a quick PR to fix the issues.

Brief summary: is_numeric isn't a defense against SQL injection, as an attacker can encode their injection as a hexadecimal number instead of ascii text - and it will pass is_numeric, but be decoded by the sql server before execution. The solution is just to cast it to an integer, which isn't large enough to hold a dangerous pile of SQL

The JSON injection comes from the fact that you were taking unsanitized data (messages containing things like usernames), and then just concatenating strings to make the curl query. This could have unexpected/dangerous results, so instead of concatenating strings, I build a PHP object and let php safely convert that to json, with all the proper escaping.