replace mysql_real_escape_string() with esc_sql() as not supported in WP 3.9 anymore