Use mysql_real_escape_string and prepared statement

Replaced depricated mysql_escape_string with mysql_real_escape_string.
Use of Prepared Statments to prevent SQL-Injections
Userpermissions with prepared Statments