Why is it recommended to use mysql_real_escape_string on string variables before inserting them into a database in PHP, and what are the exceptions to this rule?

It is recommended to use mysql_real_escape_string on string variables before inserting them into a database in PHP to prevent SQL injection attacks. This function escapes special characters in a string, making it safe to use in SQL queries. However, it is important to note that this function is deprecated as of PHP 5.5.0 and removed in PHP 7.0.0. Instead, it is recommended to use prepared statements with parameterized queries to prevent SQL injection attacks.

// Deprecated method
$unsafe_variable = "some user input";
$safe_variable = mysql_real_escape_string($unsafe_variable);

// Recommended method using prepared statements
$mysqli = new mysqli("localhost", "username", "password", "database");
$stmt = $mysqli->prepare("INSERT INTO table (column) VALUES (?)");
$stmt->bind_param("s", $unsafe_variable);
$stmt->execute();
$stmt->close();
$mysqli->close();