Add string escaping

Added clean($str) function which runs a mysql_real_escape_string and
returns a cleaned string. Also implemented this function across all
login / form values which are accessible from the public website.