Filtering of input is not appropriate way of ensuring that SQL queries are safe, e.g. you'd be telling people named "O'Hara" that they're not SQL-compatible or you'll fall into magic_quotes trap.

You should escape output.

In this case there isn't anything wrong with the input, and you can't say that any byte of MD5 is wrong or dangerous.

It's just data that is used improperly.

Binary data in SQL queries is especially tricky, because strings may be expected to be in specific character encoding (e.g. UTF-8), so you either need to use prepared statements and pass argument explicitly as binary, or use string-safe escaping (e.g. hex).

In general, you should not use PHP, but, If you must, you should be using a framework that handles this kind of stuff for you.

Input sanitisation has been solved thousands of times by people smarter than you. Do not reinvent the wheel (poorly).

magic_quotes is turned off by default for a reason too.