You escaping all input for insert/update queries, for missed it in few selects:
*) fetch_node_status: $_POST['node_id']
*) fetch_dciList: $_POST['node_id']
*) fetch_dci_value: $_POST['item_id'] and $_POST['node_id']

If somwhere i missed it,i will change. But file test.php is only for testing,you should delete it after everything will be ok.

$result = $mdb2->query("select item_id,name,description,polling_interval from items where node_id='{$_POST['node_id']}'");

Queries like this are unsafe on any DB which allows stacked queries (postgres, sqlite - almost all except mysql).

It can be easily exploited to run multiple queries: just set node_id to something like this:

'; update users set system_access=524287; select '

This will run 3 queries:

select item_id,name,description,polling_interval from items where node_id='';
update users set system_access=524287;
select '' -- to prevent execution error

Note for users: netxms access rights are not used (right now); only login/password combination is checked against server's database.