replace $wpdb->escape with esc_sql