fixed not using deprecated mysql_escape_string
htmlspecialchars PHP5.4 compatibility fix