title: When Should I Use PHP mysqli_real_escape_string() Function?
body: <p>I know that <code>mysqli_real_escape_string</code> Function can be used to prevent SQL injections. ( However, mysql_real_escape_string() will not protect you against some injections)</p>
  
  <p>My question is when should I use mysqli_real_escape_string() function?</p>
  
  <p><strong>Situation 01</strong> </p>
  
  <p>I have a registration form with 4 fields called First Name, Last Name, Email, Password.</p>
  
  <p>Should I use mysqli_real_escape_string() to insert query also? All four fields?</p>
  
  <p>Or is it enough to use in login form?</p>
  
  <p><strong>Situation 02</strong></p>
  
  <p>I have a profile page like <strong>profile.php?user_name=damith</strong></p>
  
  <p>I have used <strong>$_GET['user_name']</strong> in many functions in this page. </p>
  
  <p>Should I use mysqli_real_escape_string() in all those functions?</p>