Change mysql_real_escape_string to $db->prepare_input