title: SQL injection that gets around mysql_real_escape_string()
body: <p>Is there an SQL injection possibility even when using <code>mysql_real_escape_string()</code> function?</p>
  
  <p>Consider this sample situation. SQL is constructed in PHP like this:</p>
  
  <pre><code>$login = mysql_real_escape_string(GetFromPost('login'));
  $password = mysql_real_escape_string(GetFromPost('password'));
  
  $sql = "SELECT * FROM table WHERE login='$login' AND password='$password'";
  </code></pre>
  
  <p>I have heard numerous people say to me that code like that is still dangerous and possible to hack even with <code>mysql_real_escape_string()</code> function used. But I cannot think of any possible exploit?</p>
  
  <p>Classic injections like this:</p>
  
  <pre><code>aaa' OR 1=1 --
  </code></pre>
  
  <p>do not work.</p>
  
  <p>Do you know of any possible injection that would get through the PHP code above?</p>