title: What does mysql_real_escape_string() do that addslashes() doesn't?
body: <p>Why do we need a DB-specific functions like mysql_real_escape_string()? What can it do that addslashes() doesn't? </p>
  
  <p>Ignoring for the moment the superior alternative of parameterized queries, is a webapp that uses addslashes() exclusively still vulnerable to SQL injection, and if yes, how?</p>