[Vince]

You should use mysql_format with the %e specifier. That way you don't have to escape each individual item separately. Escaping is only necessary to tell the parser that the character that follows is part of the input value rather than a delimiter.