properly escape all strings for sql query +use mysqli for escaping + other minor tweaks