In what scenarios would it be necessary to create custom escape functions for SQL injection prevention in PHP, rather than using standard methods like prepared statements?

Custom escape functions may be necessary in scenarios where prepared statements are not feasible or practical, such as when dealing with dynamic SQL queries or legacy code that cannot be easily refactored. In such cases, creating custom escape functions can provide an additional layer of protection against SQL injection attacks by properly sanitizing user input before incorporating it into SQL queries.

function custom_escape($input) {
    // Implement custom escaping logic here
    $escaped_input = addslashes($input);
    return $escaped_input;
}

// Example usage
$user_input = $_POST['username'];
$escaped_input = custom_escape($user_input);

$query = "SELECT * FROM users WHERE username = '$escaped_input'";
// Execute the query