Keep in mind mysql_real_escape_string was deprecated and removed only for the old mysql extension. This is because mysql was phased out in favor of mysqli and pdo. So real_escape_string is still in PHP even as of PHP 7.

No, using mysql_real_escape_string is considered to be safe for any input unless the character encoding is not set properly by using mysql_client_encoding. share | improve this answer | follow |

In reality, mysql_real_escape_string is there to escape strings and prevent SQL injection on string variables. Again, In reality, mysql_real_escape_ string is used to escape strings and prevent SQL injection on string variables. Note the keywords. Numeric