My Magic_Quotes has always been on and only today I've seen it's becoming depriciated. If I have it off could I just escape all user input (whether it's being used in my database or not). I definitely can't go back and rewrite all my database queries to use mysql_real_escape_string().
Could I just loop through all my $_GET, $_POST and $_SESSION and apply mysql_real_escape_string() ?
mysql_real_escape_string and magic_quotes_gpc are two different things. Magic quotes does not render your input safe enough for SQL queries.
Whether you like it or not, you should convert all your database queries to use a proper escaping mechanism, or you otherwise leave your application open to security issues like SQL injection.
You can't really apply mysql_real_escape_string directly on $_GET, $_POST, etc. because it might mess up your input data if you need it for anything else than SQL (like form validation and such).