Update user.php

using the right input for mysql_real_escape_string