Changed database access to PDO using prepared statements

locationsubnetedit.php

@@ -12,18 +12,13 @@ include("includes.php");
 $location_id = sanitize($_GET['location_id']);
 		
 include("header.php");
-// location
-$query = "SELECT
-		location_name
-	FROM
-		location
-	WHERE
-		location_id=" . $location_id;
 
-$location = $db->db_select($query);
-
-$smarty->assign("location_id", $location_id);
-$smarty->assign("location_name", $location[0]['location_name']);
+$sql = "SELECT location_id AS id, location_name AS name
+        FROM location
+        WHERE location_id=?";
+$sth = $dbh->prepare($sql);
+$sth->execute([$zone_id]);
+$smarty->assign("location", $sth->fetch(PDO::FETCH_OBJ));
 	
 $smarty->display("locationsubnetedit.tpl");