How so? The function does what it's supposed to do. Of course you still have to write the rest of the SQL statement to make use of the escaped input - put all p

How so? The function does what it's supposed to do. Of course you still have to write the rest of the SQL statement to make use of the escaped input - put all params in quotes (or much better: use prepared statements to begin with).