fixup! WiP: replace uses of mysql_real_escape_string with parameterized SQL