Replace deprecated ->escape() with esc_sql(). Closes #2195