replacing deprecated call to $wpdb->escape with esc_sql