$db->real_escape_string should be replaced with an internal 'cleanse' function

[rctoris]

A cleanse function will provide a single, reusable function that will allow us to ensure proper escape characters are added.