Description:
------------
---
From manual page: http://www.php.net/function.mysql-real-escape-string
---
When I run the second example that is suppose to emulate an sql injection attack I don't get anything malevolent looking.

The output is

select * FROM users WHERE users='' and pasword=''.



Test script:
---------------
<?php
// Query database to check if there are any matching users
$query = "SELECT * FROM users WHERE user='{$_POST['username']}' AND password='{$_POST['password']}'";
mysql_query($query);

// We didn't check $_POST['password'], it could be anything the user wanted! For example:
$_POST['username'] = 'aidan';
$_POST['password'] = "' OR ''='";

// This means the query sent to MySQL would be:
echo $query;
?>

Expected result:
----------------
Something malevelent that would allow access with out a valid username/password combination.

Actual result:
--------------
select * FROM users WHERE users='' and pasword=''.