where mysql_real_escape_string() is needed

[sattv]

is mysql_real_escape_string() with sprintf is need only at login page or at every mysql_query after loging in....for preventing from sql injection...