mysql_real_escape_string not needed because we use prepared statements
UTF-8 everywhere