Mysqli_real_escape_string

Question

why we use Mysqli_real_escape_string?

Answer 1

It's the lowest function used to provide sql injection and those kind of thing. But it's an outdated and out of use function.
You'd better use prepared statements ;)

Answer 2

Also whitelisting with regex, if someone is trying to inject you you need to block their traffic