Fix possible SQL injection in admin page

[madsi1m]

Sanitise email field from admin form and pass it through as a placeholder so PDO uses prepare function + improved UX and search emails in lowercase.

[github-actions]

If there are selenium UI results for this code they will be at filesenderuici@93e55df

[liedekef]

Hum ... what I see here is not a change to a possible SQL injection at all. If the only concern is to allow an email to have "%" before or after it to allow wildcard searches:

• check if it starts with a "%" and set a boolean var
• check if it ends with a "%" and set another boolean var
• sanitize the email
• re-add the beginning and/or ending "%" to the sanitized value based on the boolean vars

The way it is now coded it seems easy to abuse an admin session in place by sending a link with as get-param a very "bad" email ... While PDO prepare is difficult to hack, it is not impossible:
https://stackoverflow.com/questions/134099/are-pdo-prepared-statements-sufficient-to-prevent-sql-injection