title: PHP MySQLI Prevent SQL Injection
body: <p>I've build a website that will be going live soon and just have a couple questions about preventing SQL injection, I understand how to use <code>mysqli_real_escape_string</code> but I'm just wondering if I have to use that on all variables that I'm getting for my SQL statement and do I have to use it when I'm doing select statements also or just on insert update and delete? Also what other security would you recommend me implementing before I put the site live, thanks in advance for any help!</p>