Switch to mysqli_real_escape_string on some pages.

We still have a mix of pages using mysql and mysqli; I haven't touched the former, but all pages should now be internally consistent. Fixes #30.