Unescaped: O'Reilly Escaped: O\'\'Reilly (SQL) O\\'Reilly (MySQL)
No! Always use prepared statements/parameterized queries. Manual escaping is error-prone.