removed $db-escape on $icon_id that is an int