$var_to_use_in_app = mysql_escape_string(trim($_GET['variableNameX']));
That's generally the wrong thing to do. The string as used internally in your application should always be the plain text version. Then you can be sure than none of your string manipulations will break it, and you won't be outputting the wrong thing to the page.
For example, if you had the submitted string:
O'Reilly
mysql_escape_string would escape it to:
O\'Reilly
which, when you output that string to the HTML page, would look silly. And if you outputted it to a form field that was then submitted again, you'd get another backslash, which would turn into two blackslashes, which if edited again would turn into four, eight... and in not long you've got strings composed of hundreds of backslashes. This is a commonly-seen problem in poorly-written CMSs and servers with the evil magic_quotes feature turned on.
If you then wanted to take the first two letters of the name to put in a database query, you'd snip the substring:
O\
and then concatenate that into the query:
SELECT * FROM users WHERE namefirst2='O\';
whoops, syntax error, that string is now unterminated. Variants of string-processing on pre-escaped strings can just as easily get you into security trouble.
Instead of this approach, keep your strings as simple unescaped text strings in your application everywhere except the final output stage where you concatenate them into a delimited literal in SQL or HTML. For SQL:
"SELECT * FROM users WHERE name='".mysql_real_escape_string($name)."';"
Note the ‘real’ function name — plain old mysql_escape_string fails for some corner cases like East Asian character sets and connections/databases with the ANSI SQL_MODE set, so in general you should always use the ‘real’ version.
You can define a function that is the same as mysql_real_escape_string but has a shorter name (eg. m()) to make this a bit less ugly. Or, better, look at mysqli's parameterised queries.
For HTML, the escaping should be done using the htmlspecialchars() function:
<div id="greeting">
Hello, Mr. <?php echo htmlspecialchars($name); ?>!
</div>
You can define a function that does the echo(htmlspecialchars()) but has a shorter name (eg. h()) to make this a bit less ugly.
If you have missed out the call to htmlspecialchars, then your scanner is absolutely correct in telling you that your site is vulnerable to XSS. But don't feel too bad, almost every other PHP programmer makes the same mistake.
mysql_[real_]escape_string doesn't help you at all here, because the characters that break out of text in HTML are ‘&’, ‘<’, and, in attributes, ‘"’. None of those are special in SQL string literals, so mysql_escape_string doesn't touch them at all. A malicious:
<script>alert("I'm stealing your cookies! "+document.cookie);</script>
Only gets escaped to:
<script>alert("I\'m stealing your cookies! "+document.cookie);</script>
Which, as far as security is concerned, is no help whatsoever.