php/mysql ถามเรื่องการเข้ารหัสด้วย mysql_real_escape_string ???

<?php
// Connect
$link = mysql_connect('mysql_host', 'mysql_user', 'mysql_password')
    OR die(mysql_error());

// Query
$query = sprintf("SELECT * FROM users WHERE user='%s' AND password='%s'",
            mysql_real_escape_string($user),
            mysql_real_escape_string($password));
?>

$id = $_GET['id'];
$sql = "select * from xxx where id='$id'";

$id = $_GET['id'];
$sql = "select * from xxx where id=$id";

$id = mysql_real_escape_string($_GET['id']);
$sql = "select * from xxx where id=$id";