replace deprecated wpdb->escape() with esc_sql()

use [esc_sql](https://codex.wordpress.org/Function_Reference/esc_sql) instead of wpdb->escape. esc_sql exists since 2.8 and has been preferred since 3.6.