Is it possible to prevent SQL injection without prepared statements (Node.js & MSSQL)

Question

Is it acceptable to simply escape dangerous characters from user input and then run the SQL query directly, rather than using prepared statements?

For example, could I just use the following function on the input, build the query and then execute it?

function mysql_real_escape_string (str) {
    return str.replace(/[\0\x08\x09\x1a\n\r"'\\\%]/g, function (char) {
        switch (char) {
            case "\0":
                return "\\0";
            case "\x08":
                return "\\b";
            case "\x09":
                return "\\t";
            case "\x1a":
                return "\\z";
            case "\n":
                return "\\n";
            case "\r":
                return "\\r";
            case "\"":
            case "'":
            case "\\":
            case "%":
                return "\\"+char; // prepends a backslash to backslash, percent,
                                  // and double/single quotes
        }
    });
}

Answer 1

Create Stored Procedure. Build a Data Access Layer/Service. Call methods on the service from the app passing appropriate method parameters from the application.

In my Angular code I call from a data repository layer implemented as a service injected in my components.