security: add mysql_real_escape_string() to all POST & GET variables