Added the mysqli_real_escape_string function to prevent SQL injection