Replace mysql_real_escape_string

I was getting deprecated errors, so replaced mysql_real_escape_string with esc_sql(). Seems to do the trick.