submit.php now escapes strings for HTML as well as MySQL