I do agree that I should consider implementing none direct SQL, however I am 'faily happy' with my current set-up as it does work and protect (when used correctly).
I will certainly look at none direct SQL, however I just don't feel it's my number 1 priority at the moment, especially when the template isn't even rendering in some browsers.
In all seriousness: you shouldn't be, because it clearly doesn't protect in all cases. ("Failed to wrap a query in a magic function to make it sort of safe" is part of "all cases.") You have demonstrated, by neglecting to use your "correct SQL protection techniques," why non-prepared statements are absolutely terrible. You cannot have the error you just did if you train yourself not to use direct SQL queries, regardless of library. Querying via MDB2 or PDO (or doctrine-dbal, which is a superset of PDO) means you have to intentionally and willfully do something very out-of-the-ordinary to pass in raw data as a SQL query, instead of being forced to wrap your queries in some slipshod, maybe-works-maybe-doesn't homegrown function that has not been rigorously tested.
Don't reinvent the wheel. Safe SQL queries are a solved problem.