Fix unescaped variable in SQL Query

This fixes a problem where the content of the $title variable could exploit the SQL Query. This is known as "SQL Injection".

The mysql_real_escape_string PHP function escapes the content of the variable so it can't mess with the query.