The regular mysqli_real_escape string is said to be a bad preference to escape values, but prepared statements are preferred to provide better security.

Has any of you been able to hack a database that escapes query values with the mysqli_real_escape function

Mysqli_real_escape is not bad but prepared statement is better

The wall of prepared statement is almost unbreacheable if you do it the right way.

I not sure about real escape string

And you are probably feeling lazy to switch, or don't how to use, prepared statement... I was like this b4 but I had to swallow the bitter pill

Not laziness

Just curious