A safer practise is to use parameterized SQL queries. It also has performance benefits.
The negative thing is that makes your code more complex, and thus less pretty.
See example here (note MySQLi and not MySQL)
http://www.php.net/manual/en/mysqli.prepare.php