title: mysql_escape_string vulnerabilities
body: <p>I was explaining parametrization and its advantages to my friend recently, and he asked how it was any better than <code>mysqli_escape_string</code> in terms of security. Specifically, can you think of any examples of SQL injection that would succeed despite the input strings being escaped (using mysqli_escape_string)?</p>
  
  <p>UPDATE:</p>
  
  <p>I apologise for not being clear enough in my original question. The general question being asked here is, is SQL injection possible despite escaping input strings? </p>