Only pass strings to mysqli::real_escape_string