ditched mysql_* functions for sanitizing