 <p><code>mysqli_real_escape_string</code> is good, but not always safe as prepared statement.</p> <p><code>mysql_real_escape_string()</code> prone to the same kind of issues affecting <code>addslashes()</code>.</p> <p>So use of <strong><em>prepared statement</em></strong> is much better.</p>