title: Concrete example of where mysql_real_escape_string fails and Prepared Statements are necessary
body: <p>I've been sanitising my inputs using mysql_real_escape_string amongst other functions and have recently read that Prepared Statements are the only way to be truly secure. However I am reluctant to use these for two reasons: I don't want to rewrite code and I read that using them can have an impact on performance (queries are used extensively in this application).</p>
  
  <p>So I am looking for a <strong>recent</strong>, concrete example of where mysql_real_escape_string fails in a query and the resolution is to use Prepared Statements (i.e. there is no way to further sanitise the input and guarantee it's safe).</p>
  
  <p>I ask this because the only example I could find which met the above criteria were from some time ago and have since been patched out in more up to date versions of php. </p>