sanitize user input in SQL queries using something similar to mysqli.real-escape-string