updated sql param cleansing.

mysql_real_escape_string wasn't supported in earlier versions of php, so we changed it to use a more compatible version.