escape strings to avoid SQLi

add mysqli_real_escape function for escape query