title: Is SQL injection possible with mysqli_real_escape_string?
body: <p>Is there a way to exploit this code and login as some particular username (like Sam)? mysqli_real_escape_string() function escapes all NUL (ASCII 0), \n, \r, \, ', ", and Control-Z characters.</p>
  
  <p>I tried with <code>username = "Sam"</code> and <code>domain = "' union (SELECT 1, 123456) # a"</code> but it doesn't work..</p>
  
  <pre><code>$user   = $_POST['user'];
  $domain = $_POST['domain'];
  $pwd    = $_POST['pwd'];
  
  function login($username, $domain, $password) {
      global $vuln_db;
      $starttime = microtime(true);
      $username = mysqli_real_escape_string($vuln_db, trim($username));
      $domain   = mysqli_real_escape_string($vuln_db, trim($domain));
      $password = trim($password);
      if (empty($password) || empty($username) || empty($domain)) {
          return FALSE;
      }
      // We store the password in plaintext to keep the homework's code short.
      // For anything even remotely real, use a proper password storage scheme.
      $query = "SELECT user_id, password FROM users WHERE username = '$username' AND domain LIKE '$domain'";
      $result = mysqli_query($vuln_db, $query) or die(mysqli_error($vuln_db));
      if($result) {
          $row = mysqli_fetch_row($result);
          if($row) {
              $the_password = trim($row[1]);
              for($i = 0; $i &lt; strlen($the_password); $i++) {
                  /* Bruteforce is not the way! */
                  usleep(100000);
                  if($password[$i] != $the_password[$i]) {
                      $endtime = microtime(true);
                      return FALSE;
                  }
              }
              return TRUE;
          } else {
              return FALSE;
          }
      }
  }
  </code></pre>
  
  <p>Can I get true from this function with a SQL injection or other kind of techniques?</p>