Use relative path and addslashes() instead of mysql_real_escape_string()