spamdunk at home dot com, your way is dangerous on PostgreSQL [and presumably MySQL]. You're quite correct that ANSI SQL specifies using ' to escape, but those databases also support \ for escaping [in violation of the standard, I think]. Which means that if they pass in a string that includes a "\'", you expand it to "\'''" [an escaped quote followed by a non-escaped quote. WRONG! Attackers can execute arbitrary SQL to drop your tables, make themselves administrators, whatever they want.]
The best way to be safe and correct is to:
- don't use magic quotes; this approach is bad. For starters, that's making the assumption that you will be using your input in a database query, which is arbitrary. [Why not escape all "