adding in mysql escapes for security