add mysqli_real_escape_string to users.php