Whichever handler you are using to connect to your database should have a corresponding *_escape_string function to go with it.

• PostgreSQL: pg_escape_string [php.net]
  
• MySQL: mysql_real_escape_string [php.net]
  
• SQLite: sqlite_escape_string [php.net]
  

SQL Server has different escape characters than MySQL, so no, the MySQL real escape string functions won't help you there. They'll still work, but they won't give the correct escape characters.

SQL Server uses the ' (single quote) as the escape character, so you'll need to do a find/replace on your string to add a ' in front of all the characters SQL Server doesn't like. Usually an apostrophe itself is the biggest problem, so I usually use:

function escapeSingleQuotes($string){
//escapse single quotes
$singQuotePattern = "'";
$singQuoteReplace = "''";
return(stripslashes(eregi_replace($singQuotePattern, $singQuoteReplace, $string)));
}