mysql_real_escape_string

[spider_boy]

Según el manual de PHP, esto es lo que hace :

Escapes special characters in the unescaped_string, taking into account the current character set of the connection so that it is safe to place it in a mysql_query(). If binary data is to be inserted, this function must be used.

mysql_real_escape_string() calls MySQL's library function mysql_real_escape_string, which prepends backslashes to the following characters: \x00, \n, \r, \, ', " and \x1a.

This function must always (with few exceptions) be used to make data safe before sending a query to MySQL.

\x00 = NULL ( me corrigen si me equivoco )
\x1a = SUB

Fuente : http://www.pcguide.com/res/tablesASCII-c.html