esc_sql added

I switched this to esc_sql, mysql_real_escape_string has been deprecated and put warnings on wp admin.

http://codex.wordpress.org/Function_Reference/esc_sql