add mysql_real_escape_string instead of mysql_escape_string