small changes

Use mysqli_real_escape_string on $id before passing it to query,