SQL注入和转义特殊字符

我接受来自TinyMCE的数据。当我从这样的站点复制和粘贴时，我遇到了困难:

http://www.rlslog.net/category/games/pc/

我使用以下函数来防止SQL注入和转义特殊字符，一旦我输出插入的文本，这些字符就会破坏整个页面。

$title = mysql_real_escape_string($title);
$data = mysql_real_escape_string($data);
$author= mysql_real_escape_string($author);
$data =htmlentities($data);
$title =htmlentities($title);   
$author =htmlentities($author); 
mysql_query("SET NAMES 'utf8'");
mysql_query("INSERT INTO `easy_db`.`article` (`Title`,  `Article`, `Topics`, `author`, `page`, tpage ) VALUES('$title', '$data', '$topic', '$author', '$page','$tpage')")  or die(mysql_error());
mysql_close();

当我输出数据时，我得到的是我的html文本(这不是数据库的输出)，看起来像这样:

כותרת היו×

我在php.ini中将magic_quotes_gpc关闭

magic_quotes_gpc
Default Value: Off
Development Value: Off
Production Value: Off

下面是我在phpmyadmin中引用它时的文本:

skidrow%2F&amp;layout=standard&amp;show_faces=false&amp;width=450&amp;action=like&amp;colorscheme=light&amp;height=35'" frameborder='"0'" scrolling='"no'"></iframe></p>'r'n<p class='"comments_link'" style='"padding-top: 20px; padding-right: 0px; padding-bottom: 10px; padding-left: 0px; line-height: 19px; margin: 0px;'"><a style='"color:
c02e13; text-decoration: none; padding: 0px; margin: 0px;'" title='"Comment on Orcs Must Die Fix-SKIDROW'"
href='"http://www.rlslog.net/orcs-must-die-fix-skidrow/#respond'">Comments(0)</a></p>'r'n</div>'r'n</div>'r'n<div style='"padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 40px; margin: 0px;'"><iframe style='"padding: 0px; margin: 0px;'" src='"http://www.roadcomponentsdb.com/300.htm'" frameborder='"0'" marginwidth='"0'" marginheight='"0'" scrolling='"NO'" width='"300'" height='"250'"></iframe></div>'r'n<p id='"nextlinks'" style='"padding-top: 20px; padding-right: 20px; padding-bottom: 0px; padding-left: 20px; margin: 0px;'"><strong style='"padding: 0px; margin: 0px;'">Previous post:</strong>&nbsp;<a style='"color: #c02e13; text-decoration: none; padding: 0px; margin: 0px;'" href='"http://www.rlslog.net/musclemag-international-%e2%80%93-december-2011-p2p/'">MuscleMag International &ndash; December 2011-P2P</a></p>

问题是为什么会发生?如何预防?我做足够的，以防止sql注入?