Exactly. It was meant as a reference point for the discussion to follow different paths. There's a lot of material linked at the bottom of the page on different SQL vulnerabilities, and the page itself starts off by saying "what can happen, even when mysql_real_escape_string is used"...