change all the get_records and insert/update/ etc functions to use placeholders.
invert magic_quotes_gpc hack to stripslashes rather than addslashes
take away all calls to addslashes

this was already done once (http://git.catalyst.net.nz/gitweb?p=elgg.git;a=commitdiff;h=553765dbdba08162745fe10710ac20153f3c12d2) but will need to be re-done.

All calls to *_sql will need to be migrated, although we can retain backwards compatibility by using $values=null in the function definition and only do variable substitution where $values is not empty.

this DOES break backwards compatibility in a few functinon definitions, see get_records_select in above diff.