Fixed SQL injection vulnerabilities

use mysql_real_escape_string() on any user inputs being passed to mysql_query()