Description:
------------
The manual page for mysql_real_escape_string() has a section on the danger of SQL injection; that's nice.

However, the example used to illustrate the danger is wrong and misleading, as far as I can see.

The page states
...
  // We didn't check $_POST['password'], it could be anything the user wanted! For example:
  $_POST['username'] = 'aidan';
  $_POST['password'] = "' OR 1=1";
...

However, setting $_POST['password'] to
  ' OR 1=1
will result in a query like this, which isn't very dangerous because it's a syntax error:
  SELECT * FROM users WHERE name='aidan' AND password='' OR 1=1'

A better example of a dangerous value of $_POST['password'] would be:
  ' OR ''='
because it would result in this query:
  SELECT * FROM users WHERE name='aidan' AND password='' OR ''=''