post data can be received in process page BUT i cant figure out why sql injection escape isnt working???? to be debugged later.  for now, it is open to injection