[arad55]

You're not supposed to escape the whole query string if you're doing so. You're supposed to escape user input strings only to prevent injections. Then, format a string with your query and escaped user input string to your liking.