title: Is mysql_real_escape_string vulnerable to invalid UTF-8 exploitation eg overlong UTF-8 or ill formed UTF-8 sequences?
body: <p>Assuming I have my database set up as follows to use utf-8 (the full 4mb version in mysql)</p>
  
  <pre><code>mysql_query("SET CHARACTER SET utf8mb4");
  mysql_query("SET NAMES utf8mb4");
  </code></pre>
  
  <p>I am using mysql_real_escape_string to escape unwanted characters before putting a string into sql (note - I am not looking for advice to switch to PDO, I want to establish whether mysql_real_escape_string is safe against overlong utf8 etc).</p>
  
  <pre><code>$input = mysql_real_escape_string($_POST['field']);
  $sql = "SELECT * FROM `table` WHERE `header`='$input'";
  </code></pre>
  
  <p><strong>Is there any validation I need to do to $_POST['field'] (eg. to check if the string is valid UTF-8 and is not overlong and does not contain invalid sequences etc) before doing my mysql_real_escape_string or is that sufficient?</strong></p>