title: Does mysql_real_escape_string() FULLY protect against SQL injection?
body: <p>On <a href="http://www.justinshattuck.com/2007/01/18/mysql-injection-cheat-sheet/?akst_action=share-this" rel="noreferrer">http://www.justinshattuck.com/2007/01/18/mysql-injection-cheat-sheet/?akst_action=share-this</a> , there is a section that claims you can bypass mysql_real_escape_string with certain Asian character encodings</p>
  
  <blockquote>
    <p>Bypassing mysql_real_escape_string() with BIG5 or GBK</p>
    
    <p>"injection string"<br>
    に関する追加情報：</p>
    
    <p>the above chars are Chinese Big5</p>
  </blockquote>
  
  <p>Is this really true? And if so, how would you protect your website against this, if you had no access to prepared statements?</p>