fix SOJOBO-ADV-13-01

escapes the $wp_prefix string to prevent sql injections