>I'm pretty sure you can just wrap your strings with mysql_escape_string or some similarly named function

Prepared statements have been a thing in PHP for a long time, now. Concatenating strings into SQL queries is no longer ever the right answer.