use mysqli_escape_string instead of addslashes