db_escape() protection in rest of source code