mysqli::real_escape_string only accepts strings.
Should cast all input to strings (+ HHVM is very strict about this for now... needs to be a string for unit tests to pass)