mysql selector: Always check return value of escape_str()