mysql-real-escape-string -> PDO::quote()