title: Using php filter_var with mysql_real_escape_string
body: <p>I would like to start my question by saying, I realize PDO/mysqli is the new standard and has been widely covered on SO. However in this particular case I dont have time to convert all queries to PDO before launching the clients site.</p>
  
  <p>The following has been used throughout most of the queries on the site (not by me may I add)</p>
  
  <pre><code>  $userEmail = filter_var($_POST['fEmail'], FILTER_SANITIZE_EMAIL);
     $userEmail = mysql_real_escape_string($userEmail);
     $sql ="SELECT email FROM members WHERE email = '$userEmail'";
     :
     :
  </code></pre>
  
  <p><strong>I would like to know:</strong></p>
  
  <p>Is it good / okay practise to use <code>filter_var</code> and <code>mysql_real_escape_string</code> together as in the example above? My main concern is, can these two functions be used together or cause some sort of conflict / bug when executing / uploading to DB?</p>
  
  <p>Also is there any sort of benefit in using both?</p>
  
  <p>Thanks in advance </p>