Description:
------------
It seems that mysql_real_escape_string fails to escape
the string 'a"b`c'd/e\f' (without the surrounding quotes)
right..

Reproduce code:
---------------
While magic_quotes_gpc are off and submitting on a POST form: a"b`c'd/e\f

$query = sprintf("UPDATE tbl SET field='%s'", mysql_real_escape_string($_POST['name']));
$result = mysql_query($query);



Expected result:
----------------
The mysql_error() will be a syntax error of course..

Actual result:
--------------
You have an error in your SQL syntax near 'd/e\f', ...