Use PDO instead. I don't remember the precise nick that gave me the advice on #SecurityOverride but it was well worth it to look into. I would strongly suggest using PDO for all PHP-base database access.
Depends on it, the mysqli(improved extension) is heavily influenced by PDO. It supports Transactions, prepared statements etc..
In short, when you are writing a new application just do not use mysql for the sake of depreciation. Also always, try to implement a sort of prepared statements for the sake of security.
If you are creating something that you are going to release PDO is a very good option because you can easily change Database drivers.
EDIT: also try to use the OOP version of MysqlI and PDO instead of a procedural approach.