Show that if we use mysqli_real_escape_string our scripts are still vulnerable to SQL injections. Use prepared statemnts or intval, or single qoutes for params.