Replace mysql_real_escape_string

I was getting deprecated errors, so replaced mysql_real_escape_string with esc_sql(). Seems to do the trick.
Merge pull request #1 from meredevelopment/patch-1

Replace mysql_real_escape_string