don't call escape_string_for_mysql() unnecesary
  don't overwrite local buffer
escape_string_for_mysql():
  take a length of the destination buffer as an argument