In PHP Manual, there is a note:
Note: If this function is not used to escape data, the query is vulnerable to SQL Injection Attacks.
As far as i know this is a solid way to avoid SQL Injection attacks.