SQL injection bypassing mysql_real_escape_string() — how to protect?

Hello everyone! I'm a beginner PHP developer, and I'm troubled by one question. I've read that the `mysql_real_escape_string()` function (or its analog `mysqli_real_escape_string()`) is considered a reliable protection against SQL injections. But recently I came across an old post on Stack Overflow claiming that it can be bypassed.\n\nIn my project, I use the deprecated `mysql_*` extension (I know it's deprecated, but the project is old, and there's no opportunity to rewrite everything to PDO yet). Here's an example of my code:\n\n```php\n$username = mysql_real_escape_string($_POST['username']);\n$password = mysql_real_escape_string($_POST['password']);\n$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";\n$result = mysql_query($query);\n```\n\nI naively thought that escaping characters like quotes was enough. But in that discussion, they talked about encodings, multibyte characters, and some magic with `GBK`. I didn't quite understand the essence of the vulnerability. How exactly can `mysql_real_escape_string()` be bypassed? And most importantly