Using mysql_scape_real_string to prevent sql injection