It has an escape_mysql_sql method - that alone says everything for me. It's just a big, messy mess.