thoughts:
- mysql_real_escape_string will fail if there's no mysql extension
- escape late, escape often, even if you escaped on save, always escape on output, as late as possible
- I'm not so sure you need a single meta field with a serialised array of items, just have each item in its own meta key value pair, and when you retrieve them, ask for all not just 1