Escaping will get you killed. Do you know what %u2032 means? +ACc-? %ef%bd%b1? Parameterize the query.

Ignoring the part about PHP not knowing the difference between a byte and a character...%2032? There are databases where something other than ASCII single quote will terminate a string?

Sure. It depends on the database, the way the query is constructed, and the way the handle is initialized. But the bigger problem is what the web stack does to the query before it hits the database.

People have been playing charset games to get past SQL quoting for almost 10 years now, and not just in PHP.