When mysql_real_escape_string() is needed?
<p>Is <code>mysql_real_escape_string()</code> with <code>sprintf</code> needed only at login page or at every <code>mysql_query</code> after login, for preventing SQL injection?</p>
