If you use
mysql_real_escape_string consistently every time you inject content into an SQL string literal, it's fine, there is no security issue.
However what time has taught us is that:
Catching every single place you inject into an SQL string literal is hard. In real world software unescaped cases are sometimes missed, even when the original coder understood SQL-escaping properly. Or raw injections are added later in maintenance. Or escaping is omitted where the coder thinks there is no possibility of special characters being in the string, but then later on something changes and that assumption no longer holds true.
Littering your queries with
...'.mysql_real_escape_string($value, $db).'... makes them tedious and difficult to read.
People still don't understand the encoding issue that
real relates to, and consequently fail to set the charset in the right way (
mysql_set_charset(), not bad
We can spend the rest of time chasing these issues in code written with the
mysql extension, or just push everyone to use parameterised queries instead, which work properly without requiring any deep understanding of string processing.