Why prepared statements? Why not shielding?

Question

PHP

Why is input escaping preferred over prepared statements to protect against SQL injection?
Why is mysql_real_escape_string() not safe?
Apologies in advance for the pun - I'm not sure the meaning of the expression "preferring one over the other" is correct.

Answer 1

Because shielding can be forgotten (and if something is possible, it will happen sooner or later).
There is no such problem with prepared statements.
PS Forget mysql_real_escape_string, it's gone. And in general, all mysql_* functions are no more.

Answer 2

The fact that this is a more logical step - you know exactly what query you want to execute, it is much more correct to make a template and fill it with data than to execute it anyhow.

Answer 3

They have different benefits. For example, you can use them for their intended purpose: prepare a query and substitute different values ​​in a loop.
Well, all mysql_* functions are deprecated .