Simultaneously searching listings by attributes such as category, title, postcode Is the code below safe from SQL injection?

&lt;?

mysql_connect ("localhost", "db","pass")  or die (mysql_error());
mysql_select_db ("db");

$term = mysql_real_escape_string($_POST['term']);

$sql = mysql_query("select * from tblListings where category like '%$term%' or title like '%$term%' or postcode like '%$term%' or info like '%$term%' ");

function highlight($needle, $haystack)
{
    return preg_replace('/(' . preg_quote($needle, '/') . ')/i', '&lt;mark&gt;$1&lt;/mark&gt;', $haystack);
}

while ($row = mysql_fetch_array($sql)){

    echo '&lt;br/&gt; Category: ' . highlight($term, $row['category']);
    echo '&lt;br/&gt; Title: ' . highlight($term, $row['title']);
    echo '&lt;br/&gt; Address: ' . highlight($term, $row['add1']);
    echo '&lt;br/&gt; Street: ' . highlight($term, $row['street']);
    echo '&lt;br/&gt; City: ' . highlight($term, $row['city']);
    echo '&lt;br/&gt; Postcode: ' . highlight($term, $row['postcode']);
    echo '&lt;br/&gt; Phone: ' . highlight($term, $row['phone']);
    echo '&lt;br/&gt; E-Mail: ' . highlight($term, $row['email']);
    echo '&lt;br/&gt; Website: ' . highlight($term, $row['website']);
    echo '&lt;br/&gt; Info: ' . highlight($term, $row['info']);
    echo '&lt;br/&gt;&lt;br/&gt;';
    //echo '&lt;br/&gt; E-Mail:   '.$row['email']; use this for the fields that you dont want to search

}

?&gt;
I HIGHLY suggest using PHP PDO with prepared statements ALONG with filtering each field for specific accepted characters. 

But to answer your question, your method above is no longer considered safe and can be exploited. 

PDO &amp; Tutorial:


http://php.net/manual/en/book.pdo.php  
http://net.tutsplus.com/tutorials/php/why-you-should-be-using-phps-pdo-for-database-access/


You can use preg_match to filter for specific character sequences. 

Basic Regex Filter Example:   

if (preg_match('/^[0-9-]+$/', $_POST['postcode'])) 
{
    //POSTAL CODE IS GOOD TO GO
    //Filters for charaters "0-9" along with "-" for longer postal codes
}   
else 
{
    //REJECT
}