added mysql escaping