Is the code below safe from SQL injection?<?mysql_connect (localhost, db,pass)  or die (mysql_error());mysql_select_db (db);$term = mysql_real_escape_string($_POST['term']);$sql = mysql_query(select * from tblListings where category like '%$term%' or title like '%$term%' or postcode like '%$term%' or info like '%$term%' );function highlight($needle, $haystack){    return preg_replace('/(' . preg_quote($needle, '/') . ')/i', '<mark>$1</mark>', $haystack);}while ($row = mysql_fetch_array($sql)){    echo '<br/> Category: ' . highlight($term, $row['category']);    echo '<br/> Title: ' . highlight($term, $row['title']);    echo '<br/> Address: ' . highlight($term, $row['add1']);    echo '<br/> Street: ' . highlight($term, $row['street']);    echo '<br/> City: ' . highlight($term, $row['city']);    echo '<br/> Postcode: ' . highlight($term, $row['postcode']);    echo '<br/> Phone: ' . highlight($term, $row['phone']);    echo '<br/> E-Mail: ' . highlight($term, $row['email']);    echo '<br/> Website: ' . highlight($term, $row['website']);    echo '<br/> Info: ' . highlight($term, $row['info']);    echo '<br/><br/>';    //echo '<br/> E-Mail:   '.$row['email']; use this for the fields that you dont want to search}?>
Simultaneously searching listings by attributes such as category, title, postcode
php;mysql;security;sql injection