title: mysqli_real_escape_string, should I use it?
body: <p>I want to eliminate sql injection, should I use <code>mysqli_real_escape_string()</code> or is it clear in mysqli?
  For example</p>
  
  <pre><code>$nick = mysqli_real_escape_string($_POST['nick'])
  </code></pre>