Switch to esc_sql() instead of using mysql_real_escape_string().

esc_sql() is just a better function!