update deprecated mysql_escape_string() to mysql_real_escape_string()