addslashes vs. mysql_real_escape_string

Hi, I just finished reading Chris Shiflett's article in this months php|a about SQL injection and have a question I can't seem to find answered anywhere: Does mysql_real_escape_string (or mysql_escape_string) do anything extra that addslashes() doesn't? In the examples in the manual it is just used to escape the ' character, but that is exactly what addslashes() will do anyway. Is mysql_real_escape_string tolerant of magic quotes? i.e. will you end up with double-quoted strings like: "it\\'s a lovely day" if you call it too many times? -- Best regards, Richard Davey http://www.phpcommunity.org/wiki/296.html