title: Converting from mysql_query's to prepared statements (mysqli/PDO)? Necessary?
body: <p>I have been learning PHP and MySQL over the last few weeks, and I'm just now hearing about prepared statements and PDO/mysqli. I did some reading and people are saying that stuff like:</p>
  
  <pre><code>$getFromDatabase = mysql_query("SELECT * FROM table WHERE userid='$id'");
  while($row = mysql_fetch_assoc($getFromDatabase)){
      stuff();
  }
  </code></pre>
  
  <p>...won't work anymore. I use stuff like that pretty frequently in my code. I also am reading a lot about how prepared statements are much better protection against injection. I've got a thorough understanding of how it is better, but is it so much better that it's worth switching away from mysql_real_escape_string()? Is it necessary to switch to Mysqli or PDO? In what situation could mysql_real_escape_string() be bypassed where a prepared statement couldn't?</p>