function mssql_custom_escape($str, $trim = true, $encode = true) {
    if(get_magic_quotes_gpc()) {
        $str = stripslashes($str);
    }
    if ($trim) $str = trim($str);
    if ($encode) $str = htmlspecialchars($str);

    return preg_replace("#'#", "''", $str);
}