Should be a simple enough question:
If I am using mysqli prepared statements, do I still need to use mysqli_real_escape_string() as well?
Is this necessary, or a good idea?
Thanks, Nico
No. If you use prepared statements, escaping is done for you.
来源：https://stackoverflow.com/questions/1162540/mysqli-real-escape-string-and-prepared-statements