Fix unescaped variable in SQL Query

This fixes a problem where the content of the `$title` variable could exploit the SQL Query. This is known as "[SQL Injection](http://en.wikipedia.org/wiki/SQL_injection)".

The [mysql_real_escape_string](http://www.php.net/manual/pt_BR/function.mysql-real-escape-string.php) PHP function escapes the content of the variable so it can't mess with the query.