call mysql_real_escape_string() before mysql_query()