changed mysql_escape_string with mysql_real_escape_string