Preventing SQL injection: is mysql_real_escape_string() really all I need?

Question

Possible Duplicate:
Best way to stop SQL Injection in PHP

It seems far too good to be true to me that this simple function does all I need. Yet most of my google searches lead to results that basically say "just use this function and all will be well!".

I've seen a couple that briefly, or at too high a level for my own beginner mind to quite grasp, talk about parameterized SQL statements. Are these necessary, and if so, can someone point me to a good link?

Answer 1

An alternative viewpoint: http://littlebobbytables.com/

Edit: wow, that's totally the wrong website: try this one: http://bobby-tables.com/

Answer 2

It will be all you need provided you don't change the character set of the database, IIRC.

Answer 3

Have a look at this question, excellent accepted answer: http://stackoverflow.com/questions/110575/do-htmlspecialchars-and-mysqlrealescapestring-keep-my-php-code-safe-from-injec