Do I have to use mysql_real_escape_string if I bind parameters?

Question

I have the following code:

function dbPublish($status)
{
 global $dbcon, $dbtable;

 if(isset($_GET[\'itemId\']))
 {
  $sqlQuery = \'UPDATE \' . $dbtable . \         


        

Answer 1

No, you must not. Combining the two would result in visible escape characters showing up in your data.