changed mysql_escape_string to mysql_real_escape_string