Are you implying that there's a way to get past escaping...? That's a new one to me. I thought escaping was precisely so you can put any value in a string and have it still work.
I would trust parameters much more (although I have used proper escaping in the past).