Prevent sql injection

To Prevent SQL Injections used Prepared statments
Use mysql_real_escape_sring instead of deprecated mysql_escape_string