fix mysqli_escape_string calls