$wpdb->prepare is not working like mysql_real_escape_string

Check the codexwpdb::prepare expects the first argument to be a sprintf syntax string, followed by the arguments to be injected (again, just like sprintf):

echo $wpdb->prepare( '%s', $fetch_row );