mysql escaping changed to Database::instance->escape()