Add sql_escape for extra security