Jeremy Newman : change one more incorrect call to query_real_escape_string