updates mysqli_prep() to proper mysqli_real_escape_string() syntax