mysql_real_escape_string() 仍然是針對 SQL 注入的可靠保護嗎？

If you need to change the character set of the connection, you should use the mysql_set_character_set() function rather than executing a SET NAMES (or SET CHARACTER SET) statement. mysql_set_character_set() works like SET NAMES but also affects the character set used by mysql_real_escape_string(), which SET NAMES does not.

<?php
$str = "'mystring'";

// Set encoding
mysql_set_charset('utf8');

// Escape string with correct encoding
$escaped_str = mysql_real_escape_string($str);