changed sanitize to only escape apostrophes and not use a prepared statement'