Escapes the given string to protect against SQL injection attacks. By default it assumes that backslashes are not supported as they are not part of the standard SQL spec. Quoting from the SQLlite web ...

is there a functional difference between addslashes() and mysqli_real_escape_string() or are they equally effective? i ask this because mysqli_real_escape_string() always returns a blank string. i ...

SQL injection occurs when user-supplied input is not escaped properly when it is inserted into an SQL statement. Since single quotes (') are used to delimit string literals, proper handling is ...