PHP Code:
$query= 'UPDATE table SET field="' . mysql_real_escape_string($phrase) . '"'; 
I also apologize for stating before that you couldn't escape HTML characters, I have no idea where my head was at that moment @_@ I was thinking of escaping with slashes, rather than encoding HTML entities.