added escaping to queries with user input, and removed unnecessary ?>