问SQL注入绕过mysql_real_escape_string（）？

<div ng-click="parentHandler($event)">

  <div ng-click="childHandler($event)">

  </div>

</div>

$scope.childHandler = function ($event) {

  if (wanna_stop_it()) {

    $event.stopPropagation();

  }

  ...

};

<table>

  <tr ng-repeat="user in users" ng-click="showUser(user)">

    <td>{{user.firstname}}</td>

    <td>{{user.lastname}}</td>

    <td>

      <button class="btn" ng-click="deleteUser(user.id, $index); $event.stopPropagation();">

        Delete

      </button>

    </td>              

  </tr>

</table>