Hmm... I guess that could be a problem. But, it's still worthwhile to use placeholders. Better to escape characters than to escape security.

A function may do you well though. A little longer just once, and more secure in every script.