deal with escape characters, magic quotes, and prevent sql-injection