Use mysql_real_escape_string

We were previously using the mysqli escape function.