mysql_real_escape_string() by hand

    $replace = array(
        "\x00"  => '\x00',
        "\n"    => '\n',
        "\r"    => '\r',
        '\\'    => '\\\\',
        "'"     => "\'",
        '"'     => '\"',
        "\x1a"  => '\x1a'
    );
    return strtr($string, $replace);