replace mysql_escape_string with ()