You ran that poor string through four escape functions and then bashed the survivors into a SQL string with the dot operator, missing entirely that the fifth escape attempted was escaping the string into the query. This isn't injection-proofing, it's a hostage negotiation ending in a bullet.