6.x-1.x Use of db_escape_string() in function namecards_email_list_form()

db_escape_string() only works for postgres. Needs to be removed and replace by some other method of escaping search terms before placing them in sql statement.