This may Why Hackers hate the MySQL function mysql_real_escape_string() (nscraps.com)

How old is this article? Nobody in their right mind would run PHP4 any more, and any development done in the last few years should be using PDO and prepared statements.