SQL Parameterization vs. Escaping

Question

If your language/database of choice has a built-in function to escape user-input, (for instance, mysql_real_escape_string) what are the arguments for SQL parameterization? Is it possible that mysql_real_escape_string might, at some point, leave an application vulnerable?

I use parameterization because I've been told / have read it's the better way to go, but I don't just want to follow blindly. Any insight? Thanks!

Answer 1

Arguments for parameterization is performance.

If you are going to execute the following sentence several times:

insert into table (col1, col2) values (?, ?);

It's better to use parameters since the query is going to be evaluated only (parsed, plan analysis and computation) once, and will be executed many times.