Are there any specific best practices or guidelines to follow when using mysql_real_escape_string in PHP to prevent SQL injection vulnerabilities?

To prevent SQL injection vulnerabilities when using `mysql_real_escape_string` in PHP, it is important to always sanitize user input before using it in SQL queries. This function escapes special characters in a string to prevent SQL injection attacks. It is recommended to use prepared statements with parameterized queries instead of manually escaping strings to further enhance security.

// Sanitize user input using mysql_real_escape_string
$user_input = mysql_real_escape_string($_POST['user_input']);

// Use the sanitized input in a SQL query
$query = "SELECT * FROM users WHERE username = '$user_input'";
$result = mysql_query($query);