Do htmlspecialchars and mysql_real_escape_string keep my PHP code safe from injection?

Question

Earlier today a question was asked regarding input validation strategies in web apps.

The top answer, at time of writing, suggests in PHP just using

Answer 1

why, oh WHY, would you not include quotes around user input in your sql statement? seems quite silly not to! including quotes in your sql statement would render "1 or 1=1" a fruitless attempt, no?

so now, you'll say, "what if the user includes a quote (or double quotes) in the input?"

well, easy fix for that: just remove user input'd quotes. eg: input =~ s/'//g;. now, it seems to me anyway, that user input would be secured...