use prepared statement for creating databases to avoid sql injections in custom db-names

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>

lib/Froxlor/Database/Manager/DbManagerMySQL.php

@@ -60,7 +60,10 @@ class DbManagerMySQL
 	 */
 	public function createDatabase($dbname = null)
 	{
-		Database::query("CREATE DATABASE `" . $dbname . "`");
+		$stmt = Database::prepare("CREATE DATABASE :dbname");
+		Database::pexecute($stmt, [
+			'dbname' => $dbname
+		]);
 	}
 
 	/**