I know that mysqli_real_escape_string Function can be used to prevent SQL injections. ( However, mysql_real_escape_string() will not protect you against some injections)
My question is when should I use mysqli_real_escape_string() function?
Situation 01
I have a registration form with 4 fields called First Name, Last Name, Email, Password.
Should I use mysqli_real_escape_string() to insert query also? All four fields?
Or is it enough to use in login form?
Situation 02
I have a profile page like profile.php?user_name=damith
I have used $_GET['user_name'] in many functions in this page.
Should I use mysqli_real_escape_string() in all those functions?