title: Can someone clearly explain why mysqli_prepare()/bind_param() is better than real_escape_string()?
body: <p>Okay, I still don't really get it. I keep reading that in order to properly escape your MySQL queries, you need to use <code>mysqli_prepare()</code> and <code>mysqli_bind_param()</code>.</p>
  
  <p>I tried using this setup and, quite frankly, it's a little clunkier. I'm stuck passing variables by reference when I don't need to ever reference them again, and it's just more lines of code to accomplish the same task.</p>
  
  <p>I guess I just don't get what the difference is between:</p>
  
  <pre><code>&lt;?php
  $sql = new \MySQLi(...);
  $result = $sql-&gt;query('
     UPDATE `table`
     SET
        `field` = "'.$sql-&gt;real_escape_string($_REQUEST[$field]).'";
  ');
  ?&gt;
  </code></pre>
  
  <p>and</p>
  
  <pre><code>&lt;?php
  $sql = new \MySQLi(...);
  $stmt = $sql-&gt;prepare('
     UPDATE `table`
     SET
        `field` = ?;
  ');
  $value = $_REQUEST[$field];
  $stmt-&gt;bind_param('s', $value);
  $stmt-&gt;execute();
  $result = $stmt-&gt;get_result();
  unset($value);
  ?&gt;
  </code></pre>
  
  <p>other than more code.</p>
  
  <p>I mean, did they implement this so that people wouldn't forget to escape values before sending them in a query? Or is it somehow faster?</p>
  
  <p>Or should I use this method when I intend to use the same query repeatedly (since a <code>mysqli_stmt</code> can be reused) and use the traditional method in other cases?</p>