title: PHP PEAR's escape() vs quote() vs mysql_real_escape_string()?
body: <p>Been developing an application using PHP's PEAR framework, but ran into an issue where I am double-escaping/quoting input and it wasn't letting newlines (\n) show up properly. Searching forums came up with a mix of answers, but was wondering if anyone has advice for whether using PEAR's escape() or quote() functions is enough for SQL injection security, or should I stick with using mysql_real_escape_string()? I'm trying to use nl2br() + htmlspecialchars() to spit out the content afterwards, and originally incorrectly used the following to escape input:</p>
  
  <p><code>$db-&gt;quote(mysql_real_escape_string(trim($_POST['text'])));</code></p>