added real_escape_string() to all database queries