updated mysqli_real_escape_string to use esc_sql
- fix for general warnings
- undefined var update