Do I have to check/test my code beforehand, or do these tools inform me when an attempt is being made in real time? Secondly, which one should I go for -- Suhosin or Spike or PHPIDS or a combo? What are the differences between them?
Spike is a static analysis tool and you should run it on your code before deploying it on your server. It will attempt to highlight any potential programming error which you will then need to take action to fix.
Suhosin in my experience is more about run time protection as opposed to alerting potential attacks. However it will alert on events such as scripts trying to raise memory limits and other such actions.
I have never personally deployed PHPIDS, but looking at the features that it provides you may also want to consider Apache mod_security. With mod_security it will detect events such as SQL Injection and depending on the configuration it can be logged, blocked, logged & blocked, or some other action can be taken.