title: Is "mysqli_real_escape_string" enough to avoid SQL injection or other SQL attacks?
body: <p>This is my code:</p>
  
  <pre><code>  $email= mysqli_real_escape_string($db_con,$_POST['email']);
    $psw= mysqli_real_escape_string($db_con,$_POST['psw']);
  
    $query = "INSERT INTO `users` (`email`,`psw`) VALUES ('".$email."','".$psw."')";
  </code></pre>
  
  <p>Could someone tell me if it is secure or if it is vulnerable to the SQL Injection attack or other SQL attacks ?</p>