I used this just today to demonstrate to our developers why their attempts to fix SQL injection via real_escape_string and regex wasn't a good idea. Great tool.
I know prepared statements are the way to go but proper escaping, even if tedious, seams to be OK for me.