Fix sql injection in update_ack_nak

Messages with single quotes would send data directly to sqlite

db_handler.py

@@ -53,12 +53,13 @@ def update_ack_nak(channel, timestamp, message, ack):
             db_cursor = db_connection.cursor()
             update_query = f"""
                 UPDATE {get_table_name(channel)}
-                SET ack_type = '{ack}'
-                WHERE user_id = {str(globals.myNodeNum)} AND
-                      timestamp = {timestamp} AND
-                      message_text = '{message}'
+                SET ack_type = ?
+                WHERE user_id = ? AND
+                      timestamp = ? AND
+                      message_text = ?
             """
-            db_cursor.execute(update_query)
+
+            db_cursor.execute(update_query, (ack, str(globals.myNodeNum), timestamp, message))
             db_connection.commit()
 
     except sqlite3.Error as e: