In Perl (and also in PHP, btw), you don't escape the strings, you use placeholders in your query. I don't know PHP, but here's an example for Perl:

my $sth = $dbh->prepare(<<SQL);
    SELECT (foo,bar,baz) 
    FROM dta
    WHERE (user = ? AND position < ?)
SQL

my $user = $q->param('user');
my $position = $q->param('position');
$sth->execute($user, $position);
[download]

Using placeholders protects you from injection attacks because the values are never interpolated into the SQL query by you but only by the driver for your SQL database which knows how to do this safely.

Blindly quoting everything is a stupid approach, because, as you already noticed, the quoting mechanism needs to know whether an element is supposed to be a number or a string. If you want to do the quoting manually, DBI->quote() is the correct approach to use, but you need to take care to validate your data and make sure that numbers look like numbers, strings look like strings and dates look like dates.