Question: I was using Google Apps as a REST API for a web application, but discovered that the API would not preserve plus signs whenever I attempted to insert a new record. Because of the same origin policy on browsers, the JSON had to be passed on to the API as a parameter on the URL. The process first strigifyied the JSON and then escaped the value using the escape function in JavaScript.

However, once the request reaches Google Apps, the Google process that parses the request object before reaching doGet() treats the unescaped "+" as a space.

This is a really maddening kind of bug to identify, so if anybody else comes across it, I hope my experience fixing it helps. Just use encodeURIComponent() instead of escape() and that should do the trick.

Answer: 
None of them.

Use prepared statements. They remove any kind of need for concern about what you're passing as a parameter. That's why they exist.
What a red herring!

So this is what happened. I have a URL that contains the request to the API to insert a record with a value that contains a plus. Client-side, I was using the escape function to do this, but the escape function did not encode the plus sign. When the request comes through server-side, however, apparently whatever component there is on the back end of Google Apps that parses the URL parameters then treats the plus sign as a space. It was hard to identify because within the Google Apps script itself, using unescape successfully decodes the parameter, thereby making it appear that MySQL was the problem.

The solution? I switched to using encodeURIComponent instead of escape, and now it works!