If you use any charset other than latin1 (which includes utf-8) AND you're using the C API version of mysql_real_escape_string ().
However, the best practice is still to use prepared statements and bound parameters as you're telling the server the exact query you intend to run before passing any potentially harmful data. If you're doing that, then this security vulnerability doesn't apply.
