Using PHP 5.2.6 in XAMPP :
I read about sql injections here and tried that with the following login form :
<html><body>
<form method='post' action='login.php'>
<input type='text' name='user'/>
<input type='text' name='pass'/>
<input type='submit'/>
</form>
</body></html>
and php code :
<?php
$user = $_POST['user'];
$pass = $_POST['pass'];
$query = "Select * from users where user='$user' AND pass='$pass'";
echo $query;
mysql_connect('localhost','root','');
mysql_select_db('test');
$res = mysql_query($query);
if($res) $row = mysql_fetch_assoc($res);
if($row) echo 'yes';
?>
What I found out was, the $pass variable already had all the special characters escaped.
So, is there no need to use the mysql_real_escape_string in PHP 5.2.6 then?